FreeBSD+PF+Passive Firewall=Frustration

Question

I have a FreeBSD server that I'm trying to get FTP working on. If I disable pf everything works great.

If I connect while pf is running I can login successfully-but as soon as I run an ls I get this:

ftp> ls
229 Entering Extended Passive Mode (|||61162|)

And then nothing..finally I get this: 421 Service not available, remote server timed out. Connection closed

I'm copying my pf.conf file below if anyone can help me out I'd be floored!

### macro name for external interface.
ext_if = "re0"
allowed_icmp_types = "echoreq"

### all incoming traffic on external interface is normalized and fragmented
### packets are reassembled.
scrub in on $ext_if all fragment reassemble

### FTP Proxy stuff
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"
rdr pass proto tcp from any to any port ftp -> 127.0.0.1 port 8021

### set a default deny everything policy.
block log all

### exercise antispoofing on the external interface, but add the local
### loopback interface as an exception, to prevent services utilizing the
### local loop from being blocked accidentally.
set skip on lo0
antispoof for $ext_if inet

### block anything coming from sources that we have no back routes for.
block in log from no-route to any

### block packets that fail a reverse path check. we look up the routing
### table, check to make sure that the outbound is the same as the source
### it came in on. if not, it is probably source address spoofed.
#block in from urpf-failed to any

### drop broadcast requests quietly.
block in quick on $ext_if from any to 255.255.255.255

### block packets claiming to come from reserved internal address blocks, as
### they are obviously forged and cannot be contacted from the outside world.
block in log quick on $ext_if from { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 255.255.255.255/32 } to any

### block probes that can possibly determine our operating system by disallowing
### certain combinations that are commonly used by nmap, queso and xprobe2, who
### are attempting to fingerprint the server.
### * F : FIN  - Finish; end of session
### * S : SYN  - Synchronize; indicates request to start session
### * R : RST  - Reset; drop a connection
### * P : PUSH - Push; packet is sent immediately
### * A : ACK  - Acknowledgement
### * U : URG  - Urgent
### * E : ECE  - Explicit Congestion Notification Echo
### * W : CWR  - Congestion Window Reduced
block in log quick on $ext_if proto tcp flags FUP/WEUAPRSF
block in log quick on $ext_if proto tcp flags WEUAPRSF/WEUAPRSF
block in log quick on $ext_if proto tcp flags SRAFU/WEUAPRSF
block in log quick on $ext_if proto tcp flags /WEUAPRSF
block in log quick on $ext_if proto tcp flags SR/SR
block in log quick on $ext_if proto tcp flags SF/SF

### keep state on any outbound tcp, udp or icmp traffic. modulate the isn of
### outgoing packets. (initial sequence number) broken operating systems
### sometimes don't randomize this number, making it guessable.
pass out on $ext_if proto { tcp, udp, icmp } from any to any modulate state

### normally, a client connects to the server and we handshake with them, then
### proceed to exchange data. by telling pf to handshake proxy between the client
### and our server, tcp syn flood attacts from ddos become uneffective because
### a spoofed client cannot complete a handshake.

### set a rule that allows inbound ssh traffic with synproxy handshaking.
pass in on $ext_if proto tcp from any to any port ssh flags S/SA synproxy state

### set a rule that allows inbound www traffic with synproxy handshaking.
pass in on $ext_if proto tcp from any to any port www flags S/SA synproxy state

# Allow icmp
pass in log quick inet proto icmp all icmp-type $allowed_icmp_types keep state

### lets try this
#pass in on $ext_if proto tcp from any to any port ftp flags S/SA synproxy state
pass in on $ext_if inet proto tcp from port ftp-data to ($ext_if) user proxy flags S/SA keep state
### NTP allowed
pass in on $ext_if proto tcp from any to any port ntp
pass in on $ext_if proto udp from any to any port ntp
pass out on $ext_if proto tcp to any port ntp
pass out on $ext_if proto udp to any port ntp

### FTP Passive BS
###pass in quick on $ext_if proto tcp from any to any port 30000:60000
pass in on $ext_if proto tcp from any to any port 21 keep state
#pass in on $ext_if proto tcp from any to any port > 49151 keep state

### FTP Outgoing Proxy Stuff
anchor "ftp-proxy/*"

### setup a table and ruleset that prevents excessive abuse by hosts
### that attempt to brute force the ssh daemon with repeated requests.
### any host that hammers more than 3 connections in 5 seconds gets
### all their packet states killed and dropped into a blackhole table.
table <ssh_abuse> persist
block in quick from <ssh_abuse>
pass in on $ext_if proto tcp to any port ssh flags S/SA keep state (max-src-conn 10, max-src-conn-rate 3/5, overload <ssh_abuse> flush)

Answer 1

To cover the obvious - you are running the ftp-proxy daemon, and your securelevel is <= 1, right? (see also the ftp-proxy(8) manpage which is probably more helpful than I will be - FTP and I don't get along)

In my experience FTP is horribly broken behind any halfway decent firewall -- typically I give up and allow all outbound traffic (& stateful return traffic) from the limited number of hosts that need to do FTP which usually skirts the problem nicely...

Answer 2

The problem is related to the fact that Passive FTP uses ports other than 21. Read about it here: http://slacksite.com/other/ftp.html

Usually if I setup an FTP server I'll either whitelist hosts like voretaq said or you can usually set the passive port range to use in the FTP config and just open those ports.