I read the handbook and googled, but am still confused on the right rules for my FTP server.
I use ipf. My ftp section in /etc/ipf.rules now is:
# FTP server out pass out quick on rl0 proto tcp from any to any port = 21 flags S keep state pass out quick on rl0 proto tcp from any to any port > 1024 flags S keep state # Allow in FTP from the Internet pass in quick on rl0 proto tcp from any to any port = 21 flags S keep state pass in quick on rl0 proto tcp from any to any port = 20 flags S keep state ## end
I don't feel these are right. But maybe they are. Can somebody give me advice on this?
They are not right.
# default action: block in log all block out log all
# ftp server:
# ftp session
pass in quick on rl0 proto tcp from any to 0/32 port = 21 flags S \
keep state
# passive ftp-data
pass in quick on rl0 proto tcp from any to 0/32 port > 49151 flags S \
keep state
# active ftp-data
pass out quick on rl0 proto tcp from 0/32 port = 20 to any flags S \
keep state
# end ftp-serverNote on passive ftp-data: you configure your server which ports to receive on, normally defaults to the above, if you only allow max 100 connections, you can narrow the interval to 100 ports and tighten the rule.
Note on 0/32: This is your servers ip - if you have a dynamically assigned ip, ipfilter will automatically replace it with the assigned ip. If you have fixed ip, replace with the server external ip.
No need to ftp-server out apart from the active ftp since you have keep state in all rules.
Enable ipmon, and anything that doesn't pass is logged if you have problems.
Cheers, Erik
-- Ph: +34.666334818 web: http://www.locolomo.org S/MIME Certificate: http://www.locolomo.org/crt/2004071206.crt Subject ID: A9:76:7A:ED:06:95:2B:8D:48:97:CE:F2:3F:42:C8:F2:22:DE:4C:B9 Fingerprint: 4A:E8:63:38:46:F6:9A:5D:B4:DC:29:41:3F:62:D3:0A:73:25:67:C2 _______________________________________________ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"
