up vote 1 down vote favorite
share [g+] share [fb]

I'm having a heck of a time creating a pf ruleset for FTP.

What I'm trying to do is :

Only allow $WHITELIST to connect to FTP port 21

Open ports 49152 - 65535 for Passive port range

Can anyone help me with this?

I have tried :

FTPWHITELIST="localhost, XX.XX.XX.XX"

pass in quick on $EXT_IF proto tcp from { $FTPWHITELIST } to XX.XX.XX.XX port 21 keep state

pass in quick on $EXT_IF proto tcp from { $FTPWHITELIST } to XX.XX.XX.XX port 49512 >< 65535 keep state

link|improve this question
What have you tried? – Rob Olmos Nov 28 '10 at 23:34
edited post to show what I have tried – Mayhem Nov 29 '10 at 0:10
Do you have a default deny rule? Also, the default now is to keep state. How are you testing? – Rob Olmos Nov 29 '10 at 4:26
I do not have any default deny rule - I'm testing the rules on my home computer before throwing it on the production server. The only rule I have in PF is a port redirect for the postfix mail system. – Mayhem Nov 29 '10 at 21:14
feedback

1 Answer

up vote 0 down vote

Have you tried what's mentioned in the FAQ:

http://www.openbsd.org/faq/pf/ftp.html

FTP is a fairly convoluted algorithm that's evolved over the decades (it was created in 1971), and firewalls (and even TCP/IP) weren't invented yet, so getting it to work can be troublesome.

Try to make sure you use "passive" mode on your client/s.

If possible, try to use HTTP/S or SFTP (SSH FTP) if possible. They're both much cleaner, modern designs.

link|improve this answer
Ok, FTP is working fine - how do I make it so only certain IP's are allowed to access the FTP port? – Mayhem Nov 29 '10 at 2:17
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.