From owner-freebsd-net Mon Dec 9 13:42:45 2002 Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 48E2437B401 for ; Mon, 9 Dec 2002 13:42:43 -0800 (PST) Received: from mx1.purplecat.net (mx1.purplecat.net [208.133.44.46]) by mx1.FreeBSD.org (Postfix) with ESMTP id A602B43EC2 for ; Mon, 9 Dec 2002 13:42:42 -0800 (PST) (envelope-from peter@skyrunner.net) Received: (qmail 72274 invoked from network); 9 Dec 2002 21:42:59 -0000 Received: from unknown (HELO micron) (208.150.25.130) by mx1.skyrunner.net with SMTP; 9 Dec 2002 21:42:59 -0000 From: "Peter Brezny" To: "Orville R. Weyrich_Jr" Cc: Subject: RE: passive mode ftp server, need stateful ipfw rule. Date: Mon, 9 Dec 2002 16:42:11 -0500 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 Importance: Normal In-Reply-To: <20021209145439.L45560-100000@localhost> Sender: owner-freebsd-net@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org Yes but then you run into: DYNAMIC RULES In order to protect a site from flood attacks involving fake TCP packets, it is safer to use dynamic rules: ipfw add check-state ipfw add deny tcp from any to any established And also, if you've got an: add allow all from any to any established arn't you sort of setting yourself up. Couldn't someone establish a valid connection to a valid port, then, have a field day? TIA Peter Brezny Skyrunner.net -----Original Message----- From: Orville R. Weyrich_Jr [mailto:orville@ameriroots.com] Sent: Monday, December 09, 2002 4:55 PM To: Peter Brezny Cc: freebsd-net@FreeBSD.ORG Subject: Re: passive mode ftp server, need stateful ipfw rule. Isn't that what ESTABLISHED is used for? On Mon, 9 Dec 2002, Peter Brezny wrote: > Is it possible to create an ipfw ruleset for an ftp server in passive mode > that figures out which random port the ftp server is going to open to only > allow the client that initiated the connection to connect to that port? > > > Since the client initiates it's data connection from a random port to the > new random data port on the passive mode server, i've so far not been able > to come up with decent firewall rules to protect this type of system. > > TIA, > > > Peter Brezny > Skyrunner.net > > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-net" in the body of the message > ---------------------------------------------------------------------------- --- Orville R. Weyrich, Jr PhD. KD7HJV mailto:orville@weyrich.com ---------------------------------------------------------------------------- --- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-net" in the body of the message