Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm having a heck of a time creating a pf ruleset for FTP.

What I'm trying to do is :

Only allow $WHITELIST to connect to FTP port 21

Open ports 49152 - 65535 for Passive port range

Can anyone help me with this?

I have tried :

FTPWHITELIST="localhost, XX.XX.XX.XX"

pass in quick on $EXT_IF proto tcp from { $FTPWHITELIST } to XX.XX.XX.XX port 21 keep state

pass in quick on $EXT_IF proto tcp from { $FTPWHITELIST } to XX.XX.XX.XX port 49512 >< 65535 keep state

share|improve this question
    
What have you tried? –  Rob Olmos Nov 28 '10 at 23:34
    
edited post to show what I have tried –  Mayhem Nov 29 '10 at 0:10
    
Do you have a default deny rule? Also, the default now is to keep state. How are you testing? –  Rob Olmos Nov 29 '10 at 4:26
    
I do not have any default deny rule - I'm testing the rules on my home computer before throwing it on the production server. The only rule I have in PF is a port redirect for the postfix mail system. –  Mayhem Nov 29 '10 at 21:14
add comment

1 Answer

Have you tried what's mentioned in the FAQ:

http://www.openbsd.org/faq/pf/ftp.html

FTP is a fairly convoluted algorithm that's evolved over the decades (it was created in 1971), and firewalls (and even TCP/IP) weren't invented yet, so getting it to work can be troublesome.

Try to make sure you use "passive" mode on your client/s.

If possible, try to use HTTP/S or SFTP (SSH FTP) if possible. They're both much cleaner, modern designs.

share|improve this answer
    
Ok, FTP is working fine - how do I make it so only certain IP's are allowed to access the FTP port? –  Mayhem Nov 29 '10 at 2:17
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.