Home / server / Questions / 166339
Accepted
mikl
Asked: 2010-08-03 07:45:29 +0800 CST

PF firewall issues with FTP inside FreeBSD jail

  • 772

I have recently tried to set up jails on one of my FreeBSD servers, and I’m running into strange errors while trying to download FreeBSD packages via FTP.

I have these rules in the PF firewall to allow the download of packages on the host machine, where they work fine:

ext_if = "bge0"

# Allow downloads
pass out log on $ext_if proto tcp to any port {20, 21, 22, 80, 443}

# Special exception for FTP.
pass out log on $ext_if proto tcp to any port > 49151 keep state

But when I try to install packages from inside the Jail, the FTP connection just times out.
The error message I get is this:

%pkg_add -vr bash
[snipped FTP connection setup]
>>> CWD pub/FreeBSD/ports/amd64/packages-8.1-release/Latest
<<< 250 CWD command successful.
>>> MODE S
<<< 200 MODE S accepted.
>>> TYPE I
<<< 200 Type set to I.
binding data socket
>>> PORT 82,103,140,25,229,3
<<< 200 PORT command successful.
initiating transfer
>>> RETR bash.tbz
<<< 425 Can't build data connection: Operation timed out.
Error: Unable to get ftp://ftp.freebsd.org/pub/FreeBSD/ports/amd64/packages-8.1-release/Latest/bash.tbz: Can't open data connection
pkg_add: unable to fetch 'ftp://ftp.freebsd.org/pub/FreeBSD/ports/amd64/packages-8.1-release/Latest/bash.tbz' by URL
pkg_add: 1 package addition(s) failed

Is there some sort of connection I’m missing? I wish I could just configure pkg_add to use HTTP instead of FTP (I have no idea why FreeBSD still uses that sorry excuse for a protocol), but it seems FTP is needed to operate FreeBSDs package system, and I have no idea how to make it work with the firewall. Any suggestions will be welcome :)

firewall ftp freebsd jail pf

2 Answers

  1. Best Answer

    By default FTP uses so called 'Active' mode for data transfer which is not very firewall friendly. In this mode FTP server connects to IP:port specified in PORT command sent by client (82.103.140.25:58627 in your case).

    Simplest way to fix this is to switch from 'Active' to 'Passive' FTP transfer mode. In case of 'pkg_add', which uses fetch(1) for file retrieval, it is done by setting environment variable FTP_PASSIVE_MODE.

    • 2

  2. You can try to use ftp-proxy(8) with anchor "ftp-proxy/*"

    For more info see here http://www.openbsd.org/faq/pf/ftp.html

    • 1