Jim Duda wrote:
> Tom,
> 
> Yes indeed, I figured that out last night.  I changed my configuration
> as follows (after reading more docs):
> 
> tcrules:
> 1        $FW            0.0.0.0/0       udp     4569
> 1        $FW            0.0.0.0/0       tcp     4569
> 1        $FW            0.0.0.0/0       udp     5060
> 1        $FW            0.0.0.0/0       tcp     5060
> 2        0.0.0.0/0      0.0.0.0/0       icmp    echo-request
> 2        0.0.0.0/0      0.0.0.0/0       icmp    echo-reply
> 3        0.0.0.0/0      0.0.0.0/0       tcp     20

I suspect that the above rule isn't doing what you expect.

FTP servers bind to *local* port 20 when they are creating an
active-mode connection back to the client. So the only time that there
is significant TCP traffic with destination port 20 is when an
active-mode client is *uploading* to an FTP server. So unless you have
active mode clients behind your firewall that do a significant amount of
uploading, the rule will only match ACK packets from active-mode clients
who are downloading.

-Tom
-- 
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ [EMAIL PROTECTED]
PGP Public Key   \ https://lists.shorewall.net/teastep.pgp.key

Attachment: signature.asc
Description: OpenPGP digital signature

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users

Reply via email to