up vote 1 down vote favorite
1
share [g+] share [fb]

In my csf.allow file I have (something like):

98.765.43.21
tcp:in:d=20:s=12.345.67.89
tcp:in:d=21:s=12.345.67.89

Am I right in thinking that this will 1) always allow any service for 98.765.43.21 2) deny incoming FTP connections on tcp ports for all IPs except 12.345.67.89 ?

The first IP (98.765.43.21) does not seem to deny anything, while the second two definitions seems to deny all other IPs from accessing those specified services. Is this correct?

link|improve this question
83% accept rate
feedback

1 Answer

up vote 1 down vote accepted

Yes you're right, some examples taken from the readme.txt:

# TCP connections inbound to port 3306 from IP 11.22.33.44
tcp:in:d=3306:s=11.22.33.44

# TCP connections outbound to port 22 on IP 11.22.33.44
tcp:out:d=22:d=11.22.33.44

If omitted, the default protocol is set to "tcp", the default connection
direction is set to "in"
link|improve this answer
I enter just an ip address on a single line and it is allowed but all other ips are too, so nothing is denied. But if I put tcp:in:d=20:s=12.345.67.89 this will deny that specific port to all ips except the one specified. Why are all ips not denied by entering my first ip address on single line? – Owen Jun 28 '10 at 13:55
@MOFlint: well, can't check now by I think that csf.allow OVERRIDES other blocks, so you should probably "block all" (in csf.deny or by other means) and then only what's inside csf.allow is allowed... – MrShunz Jun 30 '10 at 8:24
In the csf config file I had ports 20,21 OMITTED from "TCP_IN" - and so csf.allow just overrides this directive for the named IPs and allows them to use those ports. – Owen Jun 30 '10 at 20:52
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.