From owner-freebsd-security Tue Jun 12 12:21:43 2001 Delivered-To: freebsd-security@freebsd.org Received: from mail3.home.nl (mail3.home.nl [213.51.129.227]) by hub.freebsd.org (Postfix) with ESMTP id B97ED37B40C for ; Tue, 12 Jun 2001 12:21:16 -0700 (PDT) (envelope-from nascar24@home.nl) Received: from windows ([213.51.193.168]) by mail3.home.nl (InterMail vM.4.01.03.00 201-229-121) with SMTP id <20010612192006.CUBH29984.mail3.home.nl@windows> for ; Tue, 12 Jun 2001 20:20:06 +0100 Message-ID: <01c301c0f374$f3f3c910$0900a8c0@windows> From: "Marcel Dijk" To: References: <200106112347.JAA14067@caligula.anu.edu.au> <3B26177A.ED41EF99@centtech.com> Subject: IPFW almost works now. Date: Tue, 12 Jun 2001 21:11:38 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.00.2919.6700 X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6700 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org Hello, Thanks to some advice here and http://freebsddiary.org my IPfirewall is almost how I want it now. Only to ports I want to be open are open now, and I can access the services behind these ports. The only problem is FTP. If I try to access the FTP daemon on port 5617 from for example my work (the FTP daemon runs at home) I get an error. I can connect, I have to give my username and pass. It then esstablishes a connection and tries to execute the LIST command. But then I get this error _______________________________________ Can't build data connection: interrupted system call. ABOR command succesfull. Connection Lost _______________________________________ If I set the firewall wide-open everything works perfectly, but ofcourse I don't want a wide open firewall. I have these IPFW rules defined: ________________________________________ 00100 allow ip from any to any via lo0 00200 deny ip from any to 127.0.0.0/8 00220 divert 8668 ip from any to any via ed0 00400 deny ip from 127.0.0.0/8 to any 00615 allow tcp from any to MY_IP 22,5617,10000 00625 allow tcp from MY_IP to any 00650 allow udp from any to MY_IP 00700 allow udp from MY_IP to any 00750 allow icmp from MY_IP to any 00800 allow icmp from any to MY_IP 00850 allow ip from 192.168.0.0/16 to any 00900 allow ip from any to 192.168.0.0/16 65535 deny ip from any to any ________________________________________ (MY_IP is my public/internet IP) Can anyone give me some advice on what the problem is and how I can solve it. Just a reminder: all the other services work perfectly with this FW configuration. Marcel To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message