From owner-freebsd-security Thu Oct 11 9: 4:52 2001 Delivered-To: freebsd-security@freebsd.org Received: from straylight.ringlet.net (straylight.ringlet.net [217.75.134.254]) by hub.freebsd.org (Postfix) with SMTP id 36D3737B407 for ; Thu, 11 Oct 2001 09:04:46 -0700 (PDT) Received: (qmail 77179 invoked by uid 1000); 11 Oct 2001 16:01:37 -0000 Date: Thu, 11 Oct 2001 19:01:37 +0300 From: Peter Pentchev To: Martijn Lina Cc: freebsd-security@freebsd.org Subject: Re: firewall Message-ID: <20011011190137.E6135@straylight.oblivion.bg> Mail-Followup-To: Martijn Lina , freebsd-security@freebsd.org References: <5.1.0.14.0.20011011094352.00b022e8@rfnj.org> <20011011100410.G7007-100000@mail.wlcg.com> <20011011102432.B57251@squall.waterspout.com> <20011011182601.D6135@straylight.oblivion.bg> <20011011175208.B3267@medialab.lostboys.nl> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <20011011175208.B3267@medialab.lostboys.nl>; from martijn@medialab.lostboys.nl on Thu, Oct 11, 2001 at 05:52:08PM +0200 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org On Thu, Oct 11, 2001 at 05:52:08PM +0200, Martijn Lina wrote: > Once upon a 11-10-2001, Peter Pentchev hit keys in the following order: > > > > I believe that they are discussing the case of a server being NAT'd. > > In that case, the NAT machine has to allow for connections to ports > 1024 > > on the server to allow PASV FTP to work. > > Depends on which ftp daemon you're using. The default FreeBSD ftpd only opens a > smaller port range than just everything above 1024, according to the man page: > > "In previous versions of ftpd, when a passive mode client requested a data > connection to the server, the server would use data ports in the range > 1024..4999. Now, by default, the server will use data ports in the range > 49152..65535." > > It would be nice if the range could actually be specified through options. It can be specified. ftpd(8) only uses the high portrange defined by the net.inet.ip.portrange.* sysctls. [roam@straylight:v4 /usr/src/libexec/ftpd]$ sysctl net.inet.ip.portrange net.inet.ip.portrange.lowfirst: 1023 net.inet.ip.portrange.lowlast: 600 net.inet.ip.portrange.first: 1024 net.inet.ip.portrange.last: 5000 net.inet.ip.portrange.hifirst: 49152 net.inet.ip.portrange.hilast: 65535 [roam@straylight:v4 /usr/src/libexec/ftpd]$ So, as you can see, the default is 49152-65535, but it is easily tweakable :) G'luck, Peter -- When you are not looking at it, this sentence is in Spanish. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message