Problem: Connect to ftp.gtk.org and download files.
Get the right IP for the rule:
chris:~ chris$ host ftp.gtk.org
ftp.gtk.org is an alias for ftp.gimp.org.
ftp.gimp.org has address 128.32.112.248
Added a rule to permit it:
TCP LAN net * 128.32.112.248 21 (FTP) * Permit FTP Out to GTK Servers
Snort Capture on the LAN interface of pfSense shows the connections coming from my workstation:
snort -dvei dc0 host 128.32.112.248
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
10/29-21:57:23.611539 0:1B:63:4:80:E0 -> 0:20:78:8:66:A9 type:0x800 len:0x3E
192.168.45.242:58017 -> 128.32.112.248:21 TCP TTL:64 TOS:0x0 ID:32893 IpLen:20 DgmLen:48 DF
******S* Seq: 0xBBC5B2E Ack: 0x0 Win: 0xFFFF TcpLen: 28
TCP Options (3) => MSS: 1460 SackOK EOL
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
Snort capture on the WAN interface does not show the connetions
snort -dvei sis1 host 128.32.112.248
PfSense generates this Firewall block log:
Oct 29 22:05:43 noca pf: 199733 rule 58/0(match): block in on dc0: (tos 0x0, ttl 64, id 3075, offset 0, flags [DF], proto: TCP (6), length: 64) 192.168.45.242.58030 > 127.0.0.1.8021: S 4265331388:4265331388(0) win 65535 <mss 1460,nop,wscale 0,[|tcp]>
TCPDump on workstation shows FTP leaving appropriately:
22:04:42.994282 IP 192.168.45.242.58032 > 128.32.112.248.21: S 3720548546:3720548546(0) win 65535 <mss 1460,nop,wscale 0,nop,nop,timestamp 1730345151 0,sackOK,eol>