Date: Wed, 13 Jun 2001 00:40:21 +0300 (EEST) From: Evren Yurtesen <yurtesen@ispro.net.tr> To: Marcel Dijk <nascar24@home.nl> Cc: "Antoine Beaupre (LMC)" <Antoine.Beaupre@ericsson.ca>, "Thomas T. Veldhouse" <veldy@veldy.net>, Jason DiCioccio <Jason.DiCioccio@Epylon.com>, <freebsd-security@FreeBSD.ORG> Subject: Re: IPFW almost works now. Message-ID: <Pine.BSF.4.33.0106130039570.6329-100000@finland.ispro.net.tr> In-Reply-To: <025101c0f385$91092730$0900a8c0@windows>
next in thread | previous in thread | raw e-mail | index | archive | help
what FTP client do you use? Evren On Tue, 12 Jun 2001, Marcel Dijk wrote: > > > No you don't. My servers run fine for active and I DON'T allow access > to > > > all inbound above 1024. > > But what the problem then, I can't reach my FTP. > > Original post, but no working anwser jet :( > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > Only the ports I want to be open are open now, and I can access the services > behind these ports. The only problem is FTP. If I try to access the FTP > daemon on port 5617 from for example my work (the FTP daemon runs at home) I > get an error. > > I can connect, I have to give my username and pass. It then esstablishes a > connection and tries to execute the LIST command. But then I get this error > > _______________________________________ > Can't build data connection: interrupted system call. > ABOR command succesfull. > Connection Lost > _______________________________________ > > If I set the firewall wide-open everything works perfectly, but ofcourse I > don't want a wide open firewall. > > I have these IPFW rules defined: > > ________________________________________ > 00100 allow ip from any to any via lo0 > 00200 deny ip from any to 127.0.0.0/8 > 00220 divert 8668 ip from any to any via ed0 > 00400 deny ip from 127.0.0.0/8 to any > 00615 allow tcp from any to MY_IP 22,5617,10000 > 00625 allow tcp from MY_IP to any > 00650 allow udp from any to MY_IP > 00700 allow udp from MY_IP to any > 00750 allow icmp from MY_IP to any > 00800 allow icmp from any to MY_IP > 00850 allow ip from 192.168.0.0/16 to any > 00900 allow ip from any to 192.168.0.0/16 > 65535 deny ip from any to any > ________________________________________ > (MY_IP is my public/internet IP) > > Can anyone give me some advice on what the problem is and how I can solve > it. Just a reminder: all the other services work perfectly with this FW > configuration. > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > > > > Open up tcp/20 and tcp/21 statefully and you will be rocking and > rolling. > > > > yee-ha. > > One for the money two for the show.... > > Marcel > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-security" in the body of the message > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.4.33.0106130039570.6329-100000>