From owner-freebsd-security Wed Jun 13 7:32:21 2001 Delivered-To: freebsd-security@freebsd.org Received: from mail2.home.nl (mail2.home.nl [213.51.129.226]) by hub.freebsd.org (Postfix) with ESMTP id 915BE37B405 for ; Wed, 13 Jun 2001 07:32:14 -0700 (PDT) (envelope-from nascar24@home.nl) Received: from windows ([213.51.193.168]) by mail2.home.nl (InterMail vM.4.01.03.00 201-229-121) with SMTP id <20010613153151.WKY6179.mail2.home.nl@windows>; Wed, 13 Jun 2001 16:31:51 +0100 Message-ID: <02ba01c0f415$bfeb3fd0$0900a8c0@windows> From: "Marcel Dijk" To: "alex" , References: <252254257.992389699@[192.168.2.94]> Subject: Re: IPFW almost works now. (fwd) - correction Date: Wed, 13 Jun 2001 16:33:01 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.00.2919.6700 Disposition-Notification-To: "Marcel Dijk" X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6700 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org > correct setup for active ftp: > > allow incoming packages with destination port 20 and 21 > allow outgoing packages with source port 20 and 21 ________________________________________ 00100 allow ip from any to any via lo0 00200 deny ip from any to 127.0.0.0/8 00220 divert 8668 ip from any to any via ed0 00400 deny ip from 127.0.0.0/8 to any 00615 allow tcp from any to MY_IP 22,5617,10000 I have done the first part -> opend the port required for FTP (only a different port than normal) 00625 allow tcp from MY_IP to any 00650 allow udp from any to MY_IP 00700 allow udp from MY_IP to any As far as I know, these lines make it possible for my server to connect to everyone on every port. 00750 allow icmp from MY_IP to any 00800 allow icmp from any to MY_IP 00850 allow ip from 192.168.0.0/16 to any 00900 allow ip from any to 192.168.0.0/16 65535 deny ip from any to any ________________________________________ (MY_IP is my public/internet IP) Marcel To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message