1*0Sstevel@tonic-gateHow to setup FTP proxying using the built in proxy code. 2*0Sstevel@tonic-gate======================================================== 3*0Sstevel@tonic-gate 4*0Sstevel@tonic-gateNOTE: Currently, the built-in FTP proxy is only available for use with NAT 5*0Sstevel@tonic-gate (i.e. only if you're already using "map" rules with ipnat). It does 6*0Sstevel@tonic-gate support null-NAT mappings, that is, using the proxy without changing 7*0Sstevel@tonic-gate the addresses. 8*0Sstevel@tonic-gate 9*0Sstevel@tonic-gateLets assume your network diagram looks something like this: 10*0Sstevel@tonic-gate 11*0Sstevel@tonic-gate 12*0Sstevel@tonic-gate[host A] 13*0Sstevel@tonic-gate |a 14*0Sstevel@tonic-gate---+-------------+---------- 15*0Sstevel@tonic-gate |b 16*0Sstevel@tonic-gate [host B] 17*0Sstevel@tonic-gate |c 18*0Sstevel@tonic-gate---+-------------+---------- 19*0Sstevel@tonic-gate |d 20*0Sstevel@tonic-gate[host C] 21*0Sstevel@tonic-gate 22*0Sstevel@tonic-gateand IP Filter is running on host B. If you want to proxy FTP from A to C 23*0Sstevel@tonic-gatethen you would do: 24*0Sstevel@tonic-gate 25*0Sstevel@tonic-gatemap int-c ipaddr-a/32 -> ip-addr-c-net/32 proxy port ftp ftp/tcp 26*0Sstevel@tonic-gate 27*0Sstevel@tonic-gateint-c = name of "interface c" 28*0Sstevel@tonic-gateipaddr-a = ip# of interface a 29*0Sstevel@tonic-gateipaddr-c-net = another ip# on the C-network (usually not the same as the 30*0Sstevel@tonic-gateinterface). 31*0Sstevel@tonic-gate 32*0Sstevel@tonic-gatee.g., if host A was 10.1.1.1, host B had two network interfaces ed0 and vx0 33*0Sstevel@tonic-gatewhich had IP#'s 10.1.1.2 and 203.45.67.89 respectively, and host C was 34*0Sstevel@tonic-gate203.45.67.90, you would do: 35*0Sstevel@tonic-gate 36*0Sstevel@tonic-gatemap vx0 10.1.1.1/32 -> 203.45.67.91/32 proxy port ftp ftp/tcp 37*0Sstevel@tonic-gate 38*0Sstevel@tonic-gatewhere: 39*0Sstevel@tonic-gateipaddr-a = 10.1.1.1 40*0Sstevel@tonic-gateint-c = vx0 41*0Sstevel@tonic-gateipaddr-c-net = 203.45.67.91 42*0Sstevel@tonic-gate 43*0Sstevel@tonic-gateThe "map" rule for this proxy should precede any other NAT rules you are 44*0Sstevel@tonic-gateusing. 45*0Sstevel@tonic-gate 46