ftp-proxy, new style

	For OpenBSD 3.9 and newer
	If you are upgrading to OpenBSD 3.9 or newer equivalents or working from a fresh OpenBSD install, this is the ftp-proxy version to use.

Just like its predecessor, the pftpx successor ftp-proxy configuration is mainly a matter of cut and paste from the man page.

If you are upgrading to the new ftp-proxy from an earlier version, you need to remove the ftp-proxy line from your inetd.conf file and restart inetd or disable it altogether if your setup does not require a running inetd.

Next, enable ftp-proxy by adding the following line to your /etc/rc.conf.local or /etc/rc.conf

ftpproxy_flags=""

You can start the proxy manually by running /usr/sbin/ftp-proxy if you like.

Moving on to the pf.conf file, you need two anchor definitions in the NAT section:

nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"

Both are needed, even if your setup does not use NAT. If you are migrating from a previous version, your rule set probably contains the appropriate redirection already. If it does not, you add it:

rdr pass on $int_if proto tcp from any to any port ftp -> 127.0.0.1 \
         port 8021

Moving on down to the filtering rules, you add an anchor for the proxy to fill in,

anchor "ftp-proxy/*"

and finally a pass rule to let the packets pass from the proxy to the rest of the world

pass out proto tcp from $proxy to any port 21 keep state

where $proxy expands to the address the proxy daemon is bound to.

This example covers the simple setup with clients who need to contact FTP servers elsewhere. For other variations and more complicated setups, see the ftp-proxy man page.

If you are looking for ways to run an FTP server protected by PF and ftp-proxy, you could look into running a separate ftp-proxy in reverse mode (using the -R option).