ipfilter on Solaris question
"Christopher (home)" <[email protected]>
| Newsgroups | gmane.os.solaris.managers |
|---|---|
| Message-ID | <[email protected]> |
I have not found a good ipfilter forum after researching this problem for quite a while. Since this is the native host-based firewall on Solaris 10, I figured I would take a chance sending it to this list. If you can identify a more appropriate forum, by all means let me know. ----------------------------- I have ipfilter running on about half of my Solaris 10 servers. None thus far have needed to or allowed ftp access. We are getting in several new servers and I want to enable ipfilters on them. However they require ftp. I have been working for days on the ipf.conf rules to allow inbound and outbound ftp from/to our internal networks. I have gotten the ftp (port 20), but ftp-data(port 21) is just not working... ### ### inboand and outbound ftp, internal only. ### pass in quick on nxge0 proto tcp from 144.74/255.255.0.0 to port = ftp flags S keep state group 100 pass in quick on nxge0 proto tcp from 10.74/255.255.0.0 to port = ftp flags S keep state group 100 This works. So the initial ftp connection to this server is fine. The user just cannot upload data. I have tried pass in quick on nxge0 proto tcp from 144.74/255.255.0.0 to port = ftp-data flags S keep state group 100 pass in quick on nxge0 proto tcp from 10.74/255.255.0.0 to port = ftp-data flags S keep state group 100 no luck. I have tried pass in quick on nxge0 proto tcp from 144.74/255.255.0.0 port = ftp-data to any port > 1023 keep state group 100 pass in quick on nxge0 proto tcp from 10.74/255.255.0.0 port = ftp-data to any port > 1023 keep state group 100 also nothing. I have even tried pass in quick on nxge0 proto tcp from any to any port = ftp-data keep state group 200 pass in quick on nxge0 proto tcp from any port = ftp-data to any port > 1023 keep state group 200 can anyone point me at a doc talking about ftp through the IPFilter host-based firewall? -- Christopher L. Barnard --------------------------------------------------------------------- Comment your code as though the maintainer will be a homicidal maniac