Subject: BeroFTPD passive ports directive

From: Roger Hanke <[email-masked]>
Date: Wed, 6 Jan 1999 17:43:48 -0500

Bernhard,
 I am in the process of moving from WUFTPD Beta 13
version to BeroFTPD 1.2.3. I had been using Pedro
Melo's passive port patch in order to limit the 
range of ports I had to open up on our firewall.

 I thought the new passive ports ftpaccess command
basically gave this same capability. What I am 
confused about is the cidr initial argument.
I had assumed this would be the IP address that 
ftp clients would be using to connect to the 
server. But your ftpaccess man page describes it
as the network address instead. Was hoping you 
could expand on how this network address specification
was being used to match incoming client requests
which at least in my case would always be directed
against the same machine IP address.
	Thanx,
	Roger Hanke

-----------------------------------------------------
 Roger A. Hanke         AT&T Web Site Services
 (732)576-5738          [email-masked]
 FAX (732)576-6041      http://lynxhub.att.com/~rah/
-----------------------------------------------------

---

From: Gregory A Lundberg <[email-masked]>
Date: Thu, 7 Jan 1999 07:07:33 -0500 (EST)

On Wed, 6 Jan 1999, Roger Hanke wrote:

> Was hoping you could expand on how this network address specification
> was being used to match incoming client requests which at least in my
> case would always be directed against the same machine IP address.

passive address <externalip> <cidr>

	If a request comes *FROM* <cidr> lie by telling it the PASV port
	is listening on <externalip> instead of the machine's real IP.
	This supports NATs and other similar schemes where the machine IP
	we get by probing the interface isn't the IP the external client
	needs to know to connect to us.

passive ports <cidr> <min> <max>

	If a request comes *FROM* <cidr> only use ports in the range <min>
	to <max> for the PASV listening port.  This supports multiple
	gateways through different networks.

Consider (this isn't the way my network is set up, but it could be):

My network is 205.133.13.0/24 and I filter external requests to only allow
ports 10000-12000 through for PASV FTP.  I don't filter internal machines
and my FTP server has a real IP address.

I don't need 'passive address' since the address my machine reports will
work for everyone, but I need two 'passive ports' clauses:

passive ports 205.133.13.0/24 1024 65535
passive ports 0.0.0.0/0 10000 12000

Note I could use IP:mask specifications if I still though in those terms
as well:

passive ports 205.133.13.0:255.255.255.0 1024 65535
passive ports 0.0.0.0:0.0.0.0 10000 12000

Hmm .. looking at these examples, I see I need a better way to define
cases where I do NOT want the 'passive' clauses to take effect.  I'll
think about that for a future VR patch set; anyone have any ideas or
comments?

-- 

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195