Jim Duda wrote: > Tom, > > Yes indeed, I figured that out last night. I changed my configuration > as follows (after reading more docs): > > tcrules: > 1 $FW 0.0.0.0/0 udp 4569 > 1 $FW 0.0.0.0/0 tcp 4569 > 1 $FW 0.0.0.0/0 udp 5060 > 1 $FW 0.0.0.0/0 tcp 5060 > 2 0.0.0.0/0 0.0.0.0/0 icmp echo-request > 2 0.0.0.0/0 0.0.0.0/0 icmp echo-reply > 3 0.0.0.0/0 0.0.0.0/0 tcp 20
I suspect that the above rule isn't doing what you expect. FTP servers bind to *local* port 20 when they are creating an active-mode connection back to the client. So the only time that there is significant TCP traffic with destination port 20 is when an active-mode client is *uploading* to an FTP server. So unless you have active mode clients behind your firewall that do a significant amount of uploading, the rule will only match ACK packets from active-mode clients who are downloading. -Tom -- Tom Eastep \ Nothing is foolproof to a sufficiently talented fool Shoreline, \ http://shorewall.net Washington USA \ [EMAIL PROTECTED] PGP Public Key \ https://lists.shorewall.net/teastep.pgp.key
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
