Date: Thu, 11 Oct 2001 19:01:37 +0300 From: Peter Pentchev <roam@ringlet.net> To: Martijn Lina <martijn@medialab.lostboys.nl> Cc: freebsd-security@freebsd.org Subject: Re: firewall Message-ID: <20011011190137.E6135@straylight.oblivion.bg> In-Reply-To: <20011011175208.B3267@medialab.lostboys.nl>; from martijn@medialab.lostboys.nl on Thu, Oct 11, 2001 at 05:52:08PM %2B0200 References: <5.1.0.14.0.20011011094352.00b022e8@rfnj.org> <20011011100410.G7007-100000@mail.wlcg.com> <20011011102432.B57251@squall.waterspout.com> <20011011182601.D6135@straylight.oblivion.bg> <20011011175208.B3267@medialab.lostboys.nl>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, Oct 11, 2001 at 05:52:08PM +0200, Martijn Lina wrote: > Once upon a 11-10-2001, Peter Pentchev hit keys in the following order: > > > > I believe that they are discussing the case of a server being NAT'd. > > In that case, the NAT machine has to allow for connections to ports > 1024 > > on the server to allow PASV FTP to work. > > Depends on which ftp daemon you're using. The default FreeBSD ftpd only opens a > smaller port range than just everything above 1024, according to the man page: > > "In previous versions of ftpd, when a passive mode client requested a data > connection to the server, the server would use data ports in the range > 1024..4999. Now, by default, the server will use data ports in the range > 49152..65535." > > It would be nice if the range could actually be specified through options. It can be specified. ftpd(8) only uses the high portrange defined by the net.inet.ip.portrange.* sysctls. [roam@straylight:v4 /usr/src/libexec/ftpd]$ sysctl net.inet.ip.portrange net.inet.ip.portrange.lowfirst: 1023 net.inet.ip.portrange.lowlast: 600 net.inet.ip.portrange.first: 1024 net.inet.ip.portrange.last: 5000 net.inet.ip.portrange.hifirst: 49152 net.inet.ip.portrange.hilast: 65535 [roam@straylight:v4 /usr/src/libexec/ftpd]$ So, as you can see, the default is 49152-65535, but it is easily tweakable :) G'luck, Peter -- When you are not looking at it, this sentence is in Spanish. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20011011190137.E6135>