ipf rules for ftp server

[Erik Norgaard]

dick hoogendijk wrote:
> I read the handbook and googled, but am still confused on the right
> rules for my FTP server.
> 
> I use ipf. My ftp section in /etc/ipf.rules now is:
> 
> # FTP server out
> pass out quick on rl0 proto tcp from any to any port = 21 flags S keep
> state
> pass out quick on rl0 proto tcp from any to any port > 1024 flags S keep
> state
> # Allow in FTP from the Internet
> pass in quick on rl0 proto tcp from any to any port = 21 flags S keep
> state
> pass in quick on rl0 proto tcp from any to any port = 20 flags S keep
> state
> ## end
> 
> I don't feel these are right. But maybe they are. Can somebody give me
> advice on this?

They are not right.

# default action:
block in  log all
block out log all

# ftp server:
# ftp session
pass in quick on rl0 proto tcp from any to 0/32 port = 21 flags S \
     keep state
# passive ftp-data
pass in quick on rl0 proto tcp from any to 0/32 port > 49151 flags S \
     keep state
# active ftp-data
pass out quick on rl0 proto tcp from 0/32 port = 20 to any flags S \
     keep state
# end ftp-server

Note on passive ftp-data: you configure your server which ports to 
receive on, normally defaults to the above, if you only allow max 100 
connections, you can narrow the interval to 100 ports and tighten the rule.

Note on 0/32: This is your servers ip - if you have a dynamically 
assigned ip, ipfilter will automatically replace it with the assigned 
ip. If you have fixed ip, replace with the server external ip.

No need to ftp-server out apart from the active ftp since you have keep 
state in all rules.

Enable ipmon, and anything that doesn't pass is logged if you have problems.

Cheers, Erik

-- 
Ph: +34.666334818                           web: http://www.locolomo.org
S/MIME Certificate: http://www.locolomo.org/crt/2004071206.crt
Subject ID:  A9:76:7A:ED:06:95:2B:8D:48:97:CE:F2:3F:42:C8:F2:22:DE:4C:B9
Fingerprint: 4A:E8:63:38:46:F6:9A:5D:B4:DC:29:41:3F:62:D3:0A:73:25:67:C2