Hi Guys,
Hola..Good day!
I would like to ask for an advice about my

firewall/nat/pf box.
* network layout:
isp1---->|firewall|-->switch|----> servers

isp2---->|nat/pf  |         |----> clients
* pf.conf - http://www.openbsd.com/faq/pf/pools.html ;

as my reference i just copy this config file and

change the macro:
lan_net = "192.168.0.0/24"

int_if  = "dc0"

ext_if1 = "fxp0"

ext_if2 = "fxp1"

ext_gw1 = "68.146.224.1"

ext_gw2 = "142.59.76.1"
#  nat outgoing connections on each internet interface

nat on $ext_if1 from $lan_net to any -> ($ext_if1)

nat on $ext_if2 from $lan_net to any -> ($ext_if2)
#  default deny

block in  from any to any

block out from any to any
#  pass all outgoing packets on internal interface

pass out on $int_if from any to $lan_net

#  pass in quick any packets destined for the gateway

itself

pass in quick on $int_if from $lan_net to $int_if

#  load balance outgoing tcp traffic from internal

network.

pass in on $int_if route-to \

   { ($ext_if1 $ext_gw1), ($ext_if2 $ext_gw2) }

round-robin \

   proto tcp from $lan_net to any flags S/SA modulate

state

#  load balance outgoing udp and icmp traffic from

internal network

pass in on $int_if route-to \

   { ($ext_if1 $ext_gw1), ($ext_if2 $ext_gw2) }

round-robin \

   proto { udp, icmp } from $lan_net to any keep

state
#  general "pass out" rules for external interfaces

pass out on $ext_if1 proto tcp from any to any flags

S/SA modulate state

pass out on $ext_if1 proto { udp, icmp } from any to

any keep state

pass out on $ext_if2 proto tcp from any to any flags

S/SA modulate state

pass out on $ext_if2 proto { udp, icmp } from any to

any keep state
#  route packets from any IPs on $ext_if1 to $ext_gw1

and the same for

#  $ext_if2 and $ext_gw2

pass out on $ext_if1 route-to ($ext_if2 $ext_gw2) from

$ext_if2 to any

pass out on $ext_if2 route-to ($ext_if1 $ext_gw1) from

$ext_if1 to any
- it works fine
* Q & A

1. i try to add
nat-anchor "ftp-proxy/*"

rdr-anchor "ftp-proxy/*"

rdr on $int_if proto tcp from any to any port 21 ->

127.0.0.1 \

  port 8021
anchor "ftp-proxy/*"
but when i try to download through an ftp server it

say: 425 Security: Bad IP connecting. How can I

resolve this?
2. if there is an vpn ipsec and the its only configure

to route on $ext_if1, what do i need to add on my

pf.conf?
set skip on { lo $int_if enc0 }

pass quick on $int_if1 proto esp from any to any keep

state

pass quick on $ext_if1 proto esp from any to any keep

state

pass quick on $ext_if1 proto (tcp udp) from any to any

port 500 keep state

pass quick on $ext_if1 proto (tcp udp) from any to any

port 4500 keep state
Any advice? Thanks!
cheers,
kintaro Oe
      ____________________________________________________________________________________

Get easy, one-click access to your favorites.

Make Yahoo! your homepage.

http://www.yahoo.com/r/hs