Subject: ftpd and Firewalls (I hate PASV)

From: [email-masked]
Date: Fri, 26 Jan 1996 09:12:54 +0800

So what are people doing about FTP-PASV and filtering firewalls/routers?
It appears that the PASV request tells the ftpd to open a random
bignum ( > 1023) port on the client side.  

My understanding was that you should block incoming connections > 1023.
In particular, 1025, 2000, 2049, 2766, 6000-6xxx.  Are people that are
running ftp servers just allowing any old site to connect to any old
bignum port they want?  Or are they denying the use of the PASV command?
(Can this be done on the ftpd side of things?)

This is a BIG problem for me, as my director wants people that use Netscape
(Which does the PASV, and is apparently the only browser to do so) to be 
able to ftp to our site.

>>>Ericw
(And no, this message was not crossposted to the Firewalls/FTPD/firewall-1 
mailing lists, but was sent separately to each list.  If there is any 
conclusion to this discussion, it will be summarized, and mailed to each 
list.)

---

From: "Jeff Middleton" <[email-masked]>
Date: Fri, 26 Jan 1996 11:41:00 -0800

On Jan 26,  9:12am, [email-masked] wrote:
> Subject: ftpd and Firewalls (I hate PASV)

Some firewalls (eg. Firewall-1) can allow >1023 only to specific hosts
using a packet-filter technique.  You can set a rule to allow only ftp
and >1023 tcp packets to communicate with your ftp server.  This may
still provide an opportunity for problems though.

-- 

        ________________________________________________________________
      __   __________________________________________________________     
    ____ N _______________ 
   _____ | _______________ JEFF MIDDLETON / Staff Systems Analyst II
  _____  ^  ______________ [email-masked]
 _____  / \  _____________  
 _     / | \      ________ Western Atlas International, Inc.
 _ W -< -+- >- E  ________ Logging Services Division
 _____ \ | / _____________ P.O. Box 1407, Houston, TX 77251-1407
  _____ \ / ______________ (713) 972 4748 - Voice
   _____ v _______________ (713) 972 5524 - FAX
    ____ | _______________
      __ S __________________O_n__T_a_r_g_e_t___O_n__T_i_m_e_!_______
        _________________________________________________________________