From owner-freebsd-stable Tue Jul 23 10:33:33 2002 Delivered-To: freebsd-stable@freebsd.org Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id D660F37B400 for ; Tue, 23 Jul 2002 10:33:29 -0700 (PDT) Received: from sccrmhc02.attbi.com (sccrmhc02.attbi.com [204.127.202.62]) by mx1.FreeBSD.org (Postfix) with ESMTP id 2D6A443E42 for ; Tue, 23 Jul 2002 10:33:29 -0700 (PDT) (envelope-from crist.clark@attbi.com) Received: from blossom.cjclark.org ([12.234.91.48]) by sccrmhc02.attbi.com (InterMail vM.4.01.03.27 201-229-121-127-20010626) with ESMTP id <20020723173328.HPNU19639.sccrmhc02.attbi.com@blossom.cjclark.org>; Tue, 23 Jul 2002 17:33:28 +0000 Received: from blossom.cjclark.org (localhost. [127.0.0.1]) by blossom.cjclark.org (8.12.3/8.12.3) with ESMTP id g6NHXRJK056602; Tue, 23 Jul 2002 10:33:27 -0700 (PDT) (envelope-from crist.clark@attbi.com) Received: (from cjc@localhost) by blossom.cjclark.org (8.12.3/8.12.3/Submit) id g6NHXQ3n056601; Tue, 23 Jul 2002 10:33:26 -0700 (PDT) X-Authentication-Warning: blossom.cjclark.org: cjc set sender to crist.clark@attbi.com using -f Date: Tue, 23 Jul 2002 10:33:26 -0700 From: "Crist J. Clark" To: Scott Lambert Cc: freebsd-stable@FreeBSD.ORG Subject: Re: Enabling passive FTP on FreeBSD 4.5? Message-ID: <20020723173326.GA56146@blossom.cjclark.org> Reply-To: "Crist J. Clark" References: <016701c22edb$fcc0e250$0600a8c0@P1200n> <3D37A0A7.6070809@quack.kfu.com> <20020719122614.O21507@staff.msen.com> <20020720053558.GA3487@laptop.lambertfam.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20020720053558.GA3487@laptop.lambertfam.org> User-Agent: Mutt/1.4i X-URL: http://people.freebsd.org/~cjc/ Sender: owner-freebsd-stable@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG On Sat, Jul 20, 2002 at 01:35:59AM -0400, Scott Lambert wrote: > On Fri, Jul 19, 2002 at 12:26:14PM -0400, Michael R. Wayne wrote: > > Having recently fought IPFW on this, and having a hard time finding > > actual firewall rules to make FTP work right on a server that > > provides FTP access to the world, here is what we ended up with > > which appears to properly permit active and passive FTP. > > > > # FTP/ftp > > $fwcmd add 12501 pass tcp from any to ${ip} 20 setup # FTP-data > > $fwcmd add 12505 pass tcp from any to ${ip} 21 setup keep-state > > $fwcmd add 12507 pass tcp from any to ${ip} 49152-65535 setup # Passive FTP > > > > Watching the logs, people are managing to successfully ftp regularly. > > > > Yes, it's a hole. No, we don't like that last rule as someone > > could remotely spawn a shell on one of those ports. But we see no > > way around it as ftp access is a required service for the machine. > > Doesn't ipf with ipnat have the ability to watch the FTP control channel > and figure out when and what port to allow through for a passive FTP > data channel? It's been a while since I looked at this so I could be > smoking crack. ipf(8) wasn't originally designed to support an ftp _server_ behind NAT. IIRC, it still doesn't... but not a 100%. Take it to the IPF list, ipfilter@coombs.anu.edu.au, if you have questions about that. As for ipfw(8), you can try to use natd(8) to proxy your ftp connections, see punch_fw. -- Crist J. Clark | cjclark@alum.mit.edu | cjclark@jhu.edu http://people.freebsd.org/~cjc/ | cjc@freebsd.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message