From owner-freebsd-security  Thu Oct 11  8:29:13 2001
Delivered-To: freebsd-security@freebsd.org
Received: from straylight.ringlet.net (straylight.ringlet.net [217.75.134.254])
	by hub.freebsd.org (Postfix) with SMTP id 1CBEF37B403
	for <freebsd-security@FreeBSD.ORG>; Thu, 11 Oct 2001 08:29:05 -0700 (PDT)
Received: (qmail 75569 invoked by uid 1000); 11 Oct 2001 15:26:01 -0000
Date: Thu, 11 Oct 2001 18:26:01 +0300
From: Peter Pentchev <roam@ringlet.net>
To: Will Andrews <will@physics.purdue.edu>
Cc: Rob Simmons <rsimmons@wlcg.com>,
	Allen Landsidel <all@biosys.net>, freebsd-security@FreeBSD.ORG,
	Brock Kreiser <root63@earthlink.net>
Subject: Re: firewall
Message-ID: <20011011182601.D6135@straylight.oblivion.bg>
Mail-Followup-To: Will Andrews <will@physics.purdue.edu>,
	Rob Simmons <rsimmons@wlcg.com>, Allen Landsidel <all@biosys.net>,
	freebsd-security@FreeBSD.ORG, Brock Kreiser <root63@earthlink.net>
References: <5.1.0.14.0.20011011094352.00b022e8@rfnj.org> <20011011100410.G7007-100000@mail.wlcg.com> <20011011102432.B57251@squall.waterspout.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
In-Reply-To: <20011011102432.B57251@squall.waterspout.com>; from will@physics.purdue.edu on Thu, Oct 11, 2001 at 10:24:32AM -0500
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

On Thu, Oct 11, 2001 at 10:24:32AM -0500, Will Andrews wrote:
> On Thu, Oct 11, 2001 at 10:06:39AM -0400, Rob Simmons wrote:
> > Passive FTP requires a larger hole in the firewall than active does.  You
> > must open port 21 as well as ports > 1024.  Not good.
> > 
> > If you use ipfilter and are keeping state, you only need the one pass in
> > rule for port 21.  The state tables take care of the rest.
> 
> Er, you have that backwards.  Passive FTP requires a SMALLER hole
> because it doesn't require ports > 1024 like active does.

I believe that they are discussing the case of a server being NAT'd.
In that case, the NAT machine has to allow for connections to ports > 1024
on the server to allow PASV FTP to work.

G'luck,
Peter

-- 
I am the thought you are now thinking.

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message