Tftp-proxy between two subnets - reply blocked
-
I seem to be experiencing essentially the same thing as this post (https://forum.netgate.com/topic/44445/tftp-proxy-between-two-subnets-reply-blocked) but it my case I don't have an explicit block/log rule.
It is my expectation that tftp-proxy will add the needed rules to allow the responses from the tftp server on second internal network - otherwise what is the point of the proxy? But instead there are ICMP denials sent back. How would I see those rules? I'm not finding them myself in the pfctl -s all output.
-
@opoplawski why would you think you need a tftp proxy between your own networks.. This is for when your wanting to talk to some tftp server outside pfsense, ie out on the wan.
https://docs.netgate.com/pfsense/en/latest/config/advanced-firewall-nat.html#tftp-proxy
-
The rules created by the tftp proxy are dynamic and can be very hard to catch!
You can see them using pfanchordrill if you run it at the right time. For example see: https://redmine.pfsense.org/issues/16485
-
@stephenw10 Thanks for that. I ran it multiple times while trying a transfer but did not see any entries at all:
$ sudo pfSsh.php playback pfanchordrill ipsec rules/nat contents: natearly rules/nat contents: natrules rules/nat contents: openvpn rules/nat contents: tftp-proxy rules/nat contents: userrules rules/nat contents:I do see messages from tftp-proxy:
tftp-proxy[52265]: 10.10.20.9:41107 -> 127.0.0.1:6969/10.11.9.3:58834 -> 10.11.9.6:69 "RRQ grub/grub.cfg"@johnpoz I still think it would be useful to avoid blanket allow rules for all high port UDP ranges from the TFTP server back out.
-
Looks like it need to test this out with an updated system. I'm still running 25.07.1
