Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 27 Nov 2001 13:16:39 +0200
From:      Ruslan Ermilov <ru@FreeBSD.ORG>
To:        edwin chen <slack@suntop-cn.com>
Cc:        Danny Carroll <dannycarroll@hotmail.com>, security@FreeBSD.ORG
Subject:   Re: IPFW, natd and an internal FTP server.
Message-ID:  <20011127131639.E34943@sunbay.com>
In-Reply-To: <007e01c17733$64bc8b40$9201a8c0@home.net>
References:  <LAW2-F106gRB0OCxDqi000195a2@hotmail.com> <007e01c17733$64bc8b40$9201a8c0@home.net>

next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, Nov 27, 2001 at 07:05:10PM +0800, edwin chen wrote:
> hi, do you can send a piece of you firewall rules to me that show me how
> punch hole work ? I don't understand this function, and I am not a
> programmer don't understand source code either. thanks.
> 
This works like this:

# natd -n rl0 -punch_fw 12345:100
# ipfw list
00050 divert 8668 ip from any to any via rl0
00100 allow ip from any to any via lo0
00200 deny ip from any to 127.0.0.0/8
00300 deny ip from 127.0.0.0/8 to any
65000 allow ip from any to any
65535 deny ip from any to any
# ftp -a 192.168.4.71
ftp> deb
Debugging on (debug=1).
ftp> dir
---> PORT 192,168,4,115,192,5
200 PORT command successful.
---> LIST
150 Opening ASCII mode data connection for /bin/ls.
[...]
226 Transfer complete.
# ipfw list
00050 divert 8668 ip from any to any via rl0
00100 allow ip from any to any via lo0
00200 deny ip from any to 127.0.0.0/8
00300 deny ip from 127.0.0.0/8 to any
12346 allow tcp from 192.168.4.115 49157 to 192.168.4.71 20
12346 allow tcp from 192.168.4.71 20 to 192.168.4.115 49157
65000 allow ip from any to any
65535 deny ip from any to any

Imagine what would happen without -punch_fw if the 65000 rule
would be "allow ip from any to any out via rl0".

> ----- Original Message -----
> From: "Danny Carroll" <dannycarroll@hotmail.com>
> To: <ru@FreeBSD.ORG>
> Cc: <security@FreeBSD.ORG>
> Sent: Tuesday, November 27, 2001 2:52 AM
> Subject: Re: IPFW, natd and an internal FTP server.
> 
> 
> > Rusland,
> >
> > Works like an absolute charm...  You are a lgend.
> > Can anyone see any reason why someone should not do this?
> >
> > -D
> >
> > >Doh, you're right!  We don't currently punch firewall holes for 227/229
> > >FTP server replies, for no apparent reason.  Could you please try the
> > >attached patch?  It worked for me, both for the PASV and EPSV modes
> > >with an FTP server running on a NAT box.  You'll have to recompile both
> > >lib/libalias and sbin/natd, in that order.


Cheers,
-- 
Ruslan Ermilov		Oracle Developer/DBA,
ru@sunbay.com		Sunbay Software AG,
ru@FreeBSD.org		FreeBSD committer,
+380.652.512.251	Simferopol, Ukraine

http://www.FreeBSD.org	The Power To Serve
http://www.oracle.com	Enabling The Information Age

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20011127131639.E34943>