ipfilter on Solaris question

"Christopher (home)" <[email protected]>
Newsgroups gmane.os.solaris.managers
Message-ID <[email protected]>
I have not found a good ipfilter forum after researching this problem for
quite a while.  Since this is the native host-based firewall on Solaris 10, I
figured I would take a chance sending it to this list.  If you can identify a
more appropriate  forum, by all means let me know.

-----------------------------

I have ipfilter running on about half of my Solaris 10 servers.  None
thus far have needed to or allowed ftp access.

We are getting in several new servers and I want to enable ipfilters on
them.  However they require ftp.  I have been working for days on the
ipf.conf rules to allow inbound and outbound ftp from/to our internal
networks.  I have gotten the ftp (port 20), but ftp-data(port 21) is
just not working...

###
### inboand and outbound ftp, internal only.
###

pass in quick on nxge0 proto tcp from 144.74/255.255.0.0 to port = ftp flags S
keep state group 100
pass in quick on nxge0 proto tcp from 10.74/255.255.0.0 to port = ftp flags S
keep state group 100

This works.  So the initial ftp connection to this server is fine.  The
user just cannot upload data.  I have tried

pass in quick on nxge0 proto tcp from 144.74/255.255.0.0 to port = ftp-data
flags S keep state group 100
pass in quick on nxge0 proto tcp from 10.74/255.255.0.0 to port = ftp-data
flags S keep state group 100

no luck.  I have tried

pass in quick on nxge0 proto tcp from 144.74/255.255.0.0 port = ftp-data to
any port > 1023 keep state group 100
pass in quick on nxge0 proto tcp from 10.74/255.255.0.0 port = ftp-data to any
port > 1023 keep state group 100

also nothing.  I have even tried

pass in quick on nxge0 proto tcp from any to any port = ftp-data keep state
group 200
pass in quick on nxge0 proto tcp from any port = ftp-data to any port > 1023
keep state group 200

can anyone point me at a doc talking about ftp through the IPFilter host-based
firewall?

--
Christopher L. Barnard
---------------------------------------------------------------------
Comment your code as though the maintainer will be a homicidal maniac
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.