firewall configuring

[Reindl Harald]

Am 14.11.2012 18:01, schrieb lee:
>> ftp is ALWAYS using random ports
>>
>> active:  on the client side
>> passive: on the server side
>>
>> so on one side there must be a firewall rule or connection
>> tracking for sure depending on the ftp-mode, how the tracking
>> is made is a implementation detail
> 
> There isn't anything random about these ports, see
> http://en.wikipedia.org/wiki/File_Transfer_Protocol

surely

pure-ftpd: PassivePortRange 10000 10100
you get a random port for the data-connection which
is specified by the server and without configuration
a port between 1025 and 65535 as for any other ftp-server

so the client get over the control-connection to which
dataport he has to connect, this port must be open for
the client on the server side

for active ftp it is the opposite: the client is choosing
a random port, notfies the server which port and the server
makes a new data connection

in both cases the firewall must open this connection

no matter how it is implemented, but it must do this


>> nf_conntrack: automatic helper assignment is deprecated and it will be removed soon. Use the iptables CT target to
>> attach helpers instead.
> 
> I don't know what you mean --- I haven't looked into it since a very
> long time, and when I did, there was an extra kernel module to handle
> ftp connections in combination with some firewall rules to allow traffic
> on the data ports.  There wasn't anything random about it.  So what has
> changed?

yes, and nf_conntrack FTP opens dynamically the data-connection
but it is a part of iptables/firewall
so it is random and the firewall has to know about it

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 261 bytes
Desc: OpenPGP digital signature
URL: <http://lists.fedoraproject.org/pipermail/users/attachments/20121115/7f78acbf/attachment.sig>