Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 14 Jan 2002 08:39:18 -0800 (PST)
From:      Chris Appleton <appleton_chris@yahoo.com>
To:        binary@b1n.org, r.j.s@gmx.net
Cc:        freebsd-questions@freebsd.org
Subject:   Re: ipfw rules
Message-ID:  <20020114163918.21575.qmail@web14802.mail.yahoo.com>
In-Reply-To: <20020112131010.B31058@b1n.org>

next in thread | previous in thread | raw e-mail | index | archive | help
--- BinarySoul <binary@b1n.org> wrote:
> Dont forget opening 20 (ftp-data) too or ftp wont work.
> 
> Rogier Steehouder (r.j.s@gmx.net) wrote:
> > On 11-01-2002 12:05 (-0800), Chris Appleton wrote:
> > > allow tcp from any 21 to a.b.c.d
> > 
> > This means allow connections from port 21 on any machine to any
> port on
> > a.b.c.d, so you completely opened up your system.
> > 
> > What you're probably looking for is:
> > 
> > allow tcp from any to a.b.c.d 21
> > 
> > Allow any machine to connect to only port 21 on a.b.c.d

in case you can't see it, i'm repeatedly kicking myself in the ass. 
hallelujah it's alive.
i did get a stern warning about this and maybe you know if i'm exposed:
(this is a 4.4-r bridge)
allow ip from any a.b.c.d/24 to any
allow tcp from any to any established
allow udp from any 53 to any
allow tcp from any to a.b.c.d/24 21

(apart from needing 20 for data) is the 'established' rule creating a
big hole considering the 21 request in is essentially an established
connection.  is there something i can do to keep the benefit of not
having 2 rules for every port like established does?

thanks for the reply, a wieght has been lifted

chris


__________________________________________________
Do You Yahoo!?
Send FREE video emails in Yahoo! Mail!
http://promo.yahoo.com/videomail/

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020114163918.21575.qmail>