openbsd ftp-proxy setup with fwbuilder

[Koenig, Thomas-2]

Hello,

I try to use the openbsd ftp-proxy together with the fwbuilder. I found some
Howtos for the configuration for openbsd versions before 3.9. But since 4.0
the ftp-proxy runs as standalone application and dont support the "-n" flag.

In the current fwbuilder release notes its described as follow:

New feature: Added support for anchor names with "/*" suffix for PF. Now the
user can create policy ruleset with name e.g. "ftp-proxy/*" and then set up
branching rule pointing to this ruleset. This ruleset is treated by the
program in a special way. First, it allows characters "/" and "*" in the
name of the ruleset (but only for PF firewalls). Second, compiler does not
create a .conf file with rules from this ruleset, assuming that it will be
controlled by external program such as ftp-proxy. See man page ftp-proxy(8)
for examples. Also, if policy ruelset name ends with "/*", the program
assumes it is controlled by external means and does not compile rules in it
and does not create .conf file from it.

Did anyone know a howto, wich describe this way, step-by-step?


regards,
thomas


------------------------------------------------------------------------------
Come build with us! The BlackBerry® Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay
ahead of the curve. Join us from November 9-12, 2009. Register now!
http://p.sf.net/sfu/devconf
_______________________________________________
Fwbuilder-discussion mailing list
Fwbuilder-discussion@...
https://lists.sourceforge.net/lists/listinfo/fwbuilder-discussion

[Vadim Kurland ✎]

On Sep 16, 2009, at 6:56 AM, Koenig, Thomas wrote:

> Hello,
>
> I try to use the openbsd ftp-proxy together with the fwbuilder. I  
> found some
> Howtos for the configuration for openbsd versions before 3.9. But  
> since 4.0
> the ftp-proxy runs as standalone application and dont support the "-
> n" flag.
>
> In the current fwbuilder release notes its described as follow:
>
> New feature: Added support for anchor names with "/*" suffix for PF.  
> Now the
> user can create policy ruleset with name e.g. "ftp-proxy/*" and then  
> set up
> branching rule pointing to this ruleset. This ruleset is treated by  
> the
> program in a special way. First, it allows characters "/" and "*" in  
> the
> name of the ruleset (but only for PF firewalls). Second, compiler  
> does not
> create a .conf file with rules from this ruleset, assuming that it  
> will be
> controlled by external program such as ftp-proxy. See man page ftp-
> proxy(8)
> for examples. Also, if policy ruelset name ends with "/*", the program
> assumes it is controlled by external means and does not compile  
> rules in it
> and does not create .conf file from it.
>
> Did anyone know a howto, wich describe this way, step-by-step?

building branching rules is described in details in the Users Guide  
(linked off the main page on the web site). See chapter "Firewall  
Builder Cookbook" , "Branching Rules".

As far as I understand how ftp-proxy works, you just create a branch  
in your policy to point to anchor "ftp-proxy/*"  (see examples in the  
Guide how to do this) but do not put any rules in the ruleset with  
this name because the proxy will do it.

--vk



------------------------------------------------------------------------------
Come build with us! The BlackBerry® Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay
ahead of the curve. Join us from November 9-12, 2009. Register now!
http://p.sf.net/sfu/devconf
_______________________________________________
Fwbuilder-discussion mailing list
Fwbuilder-discussion@...
https://lists.sourceforge.net/lists/listinfo/fwbuilder-discussion