From owner-freebsd-security@FreeBSD.ORG  Mon Aug  4 08:04:14 2003
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 189F137B43D
	for <freebsd-security@freebsd.org>;
	Mon,  4 Aug 2003 08:04:14 -0700 (PDT)
Received: from cactus.fi.uba.ar (cactus.fi.uba.ar [157.92.49.108])
	by mx1.FreeBSD.org (Postfix) with ESMTP id C218743F85
	for <freebsd-security@freebsd.org>;
	Mon,  4 Aug 2003 08:04:12 -0700 (PDT)
	(envelope-from fgleiser@cactus.fi.uba.ar)
Received: from cactus.fi.uba.ar (cactus.fi.uba.ar [157.92.49.108])
	by cactus.fi.uba.ar (8.12.3/8.12.3) with ESMTP id h74F0meA059510;
	Mon, 4 Aug 2003 12:00:48 -0300 (ART)
	(envelope-from fgleiser@cactus.fi.uba.ar)
Date: Mon, 4 Aug 2003 12:00:48 -0300 (ART)
From: Fernando Gleiser <fgleiser@cactus.fi.uba.ar>
To: michael <michael@nettmail.de>
In-Reply-To: <1059927875.3f2d37432c3fa@mx5.internett.de>
Message-ID: <20030804115302.J59403-100000@cactus.fi.uba.ar>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
X-Spam-Status: No, hits=-120.1 required=5.0
	tests=EMAIL_ATTRIBUTION,IN_REP_TO,QUOTED_EMAIL_TEXT,
	      QUOTE_TWICE_1,REPLY_WITH_QUOTES,USER_IN_WHITELIST
	version=2.53
X-Spam-Checker-Version: SpamAssassin 2.53 (1.174.2.15-2003-03-30-exp)
cc: freebsd-security@freebsd.org
Subject: Re: ipfw or ipf w/stateful behavior
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security issues [members-only posting]
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 04 Aug 2003 15:04:14 -0000

On Sun, 3 Aug 2003, michael wrote:

> well, back to the essentials:
>
> under linux can i load a kernelmodule for masquerading ftp-connections and
> this allows me to close any port from outside except the ports for
> Management or administration. these make the firewall secure enaugh.

with ipf/ipnat there's a built-in ftp proxy, just add

map xl0 192.168.0.0/24 -> <externalip> proxy port ftp ftp/tcp

to the top of your ipnat.rules file. Change the IPs and interface
to meet your setup.

>
> May under FreeBSD it give no KLD_MODULE that solve the problem with ftp/or
> irc.

The above line is the ipf's equivalent of the linux module.


				Fer