Date: Tue, 12 Jun 2001 23:20:55 +0200 From: "Marcel Dijk" <nascar24@home.nl> To: "Antoine Beaupre (LMC)" <Antoine.Beaupre@ericsson.ca>, "Thomas T. Veldhouse" <veldy@veldy.net> Cc: "Jason DiCioccio" <Jason.DiCioccio@Epylon.com>, <freebsd-security@FreeBSD.ORG> Subject: Re: IPFW almost works now. Message-ID: <025101c0f385$91092730$0900a8c0@windows> References: <657B20E93E93D4118F9700D0B73CE3EA0166D97D@goofy.epylon.lan> <01fe01c0f37e$c5948e10$3028680a@tgt.com> <3B267EDA.9070605@lmc.ericsson.se>
next in thread | previous in thread | raw e-mail | index | archive | help
> > No you don't. My servers run fine for active and I DON'T allow access to > > all inbound above 1024. But what the problem then, I can't reach my FTP. Original post, but no working anwser jet :( ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Only the ports I want to be open are open now, and I can access the services behind these ports. The only problem is FTP. If I try to access the FTP daemon on port 5617 from for example my work (the FTP daemon runs at home) I get an error. I can connect, I have to give my username and pass. It then esstablishes a connection and tries to execute the LIST command. But then I get this error _______________________________________ Can't build data connection: interrupted system call. ABOR command succesfull. Connection Lost _______________________________________ If I set the firewall wide-open everything works perfectly, but ofcourse I don't want a wide open firewall. I have these IPFW rules defined: ________________________________________ 00100 allow ip from any to any via lo0 00200 deny ip from any to 127.0.0.0/8 00220 divert 8668 ip from any to any via ed0 00400 deny ip from 127.0.0.0/8 to any 00615 allow tcp from any to MY_IP 22,5617,10000 00625 allow tcp from MY_IP to any 00650 allow udp from any to MY_IP 00700 allow udp from MY_IP to any 00750 allow icmp from MY_IP to any 00800 allow icmp from any to MY_IP 00850 allow ip from 192.168.0.0/16 to any 00900 allow ip from any to 192.168.0.0/16 65535 deny ip from any to any ________________________________________ (MY_IP is my public/internet IP) Can anyone give me some advice on what the problem is and how I can solve it. Just a reminder: all the other services work perfectly with this FW configuration. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > Open up tcp/20 and tcp/21 statefully and you will be rocking and rolling. > > yee-ha. One for the money two for the show.... Marcel To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?025101c0f385$91092730$0900a8c0>