Skip site navigation (1)Skip section navigation (2)
Date:      Thu, 11 Oct 2001 19:01:37 +0300
From:      Peter Pentchev <roam@ringlet.net>
To:        Martijn Lina <martijn@medialab.lostboys.nl>
Cc:        freebsd-security@freebsd.org
Subject:   Re: firewall
Message-ID:  <20011011190137.E6135@straylight.oblivion.bg>
In-Reply-To: <20011011175208.B3267@medialab.lostboys.nl>; from martijn@medialab.lostboys.nl on Thu, Oct 11, 2001 at 05:52:08PM %2B0200
References:  <5.1.0.14.0.20011011094352.00b022e8@rfnj.org> <20011011100410.G7007-100000@mail.wlcg.com> <20011011102432.B57251@squall.waterspout.com> <20011011182601.D6135@straylight.oblivion.bg> <20011011175208.B3267@medialab.lostboys.nl>

next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, Oct 11, 2001 at 05:52:08PM +0200, Martijn Lina wrote:
> Once upon a 11-10-2001, Peter Pentchev hit keys in the following order:
> > 
> > I believe that they are discussing the case of a server being NAT'd.
> > In that case, the NAT machine has to allow for connections to ports > 1024
> > on the server to allow PASV FTP to work.
> 
> Depends on which ftp daemon you're using. The default FreeBSD ftpd only opens a
> smaller port range than just everything above 1024, according to the man page:
> 
> "In previous versions of ftpd, when a passive mode client requested a data
> connection to the server, the server would use data ports in the range
> 1024..4999.  Now, by default, the server will use data ports in the range
> 49152..65535."
> 
> It would be nice if the range could actually be specified through options.

It can be specified.  ftpd(8) only uses the high portrange defined by
the net.inet.ip.portrange.* sysctls.

[roam@straylight:v4 /usr/src/libexec/ftpd]$ sysctl net.inet.ip.portrange
net.inet.ip.portrange.lowfirst: 1023
net.inet.ip.portrange.lowlast: 600
net.inet.ip.portrange.first: 1024
net.inet.ip.portrange.last: 5000
net.inet.ip.portrange.hifirst: 49152
net.inet.ip.portrange.hilast: 65535
[roam@straylight:v4 /usr/src/libexec/ftpd]$

So, as you can see, the default is 49152-65535, but it is easily tweakable :)

G'luck,
Peter

-- 
When you are not looking at it, this sentence is in Spanish.

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20011011190137.E6135>