ipf rules for ftp server

[Dick Hoogendijk]

On 25 Jan Erik Norgaard wrote:
> They are not right.
> # ftp server - ftp session
> pass in quick on rl0 proto tcp from any to 0/32 port = 21 flags S \
>     keep state
> # passive ftp-data
> pass in quick on rl0 proto tcp from any to 0/32 port > 49151 flags S \
>     keep state
> # active ftp-data
> pass out quick on rl0 proto tcp from 0/32 port = 20 to any flags S \
>     keep state

OK, thanks. It seems to work ;-)

Now I can concentrate on ftp clients from inside the local network.
People want to have ftp access from local clients.

I think it's enough to add just one rule:
pass out quick on rl0 proto tcp from any to any port = 21 flags S \
keep state

I don't understand what the proxy rules mean, mentioned in the handbook
in the chapter on ipf.

I'm gonna google a little more on "ipf ftp clients" and maybe I have
some luck :-)

-- 
dick -- http://www.nagual.st/ -- PGP/GnuPG key: F86289CE
++ Running FreeBSD 4.10 ++ Debian GNU/Linux (Woody)
+ Nai tiruvantel ar vayuvantel i Valar tielyanna nu vilja