Subject: RE: VR/BeroFTPD passive ports directive

From: Gregory A Lundberg <[email-masked]>
Date: Thu, 7 Jan 1999 11:18:54 -0500 (EST)

Yes.

-- 

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: Roger Hanke <[email-masked]>
Date: Thu, 7 Jan 1999 10:31:13 -0500

Gregory,
 Wanted to make sure I understand 
how to use this for the
simple case of the client using PASV vs PORT command where no NAT is
involved but the client source IP
is not known and could be any number. And since my
internal users could actually be coming from quite
a varied range of subnets I would have to add too 
many clauses to try to add exclusions for them
it looks like.
So it sounds like the one line below would serve
my needs, but just to double check I described below
it the current scheme I was using with WUFTPD.

passive ports 0.0.0.0:0.0.0.0 10000 12000 

 What I had used Pedro Melo's patch for was for 
all the newer (browser for example) ftp clients
that were using PASV mode. So was using the 
PASSIVE_BASE and PASSIVE_SPAN variables to define
the starting port number and range of port numbers
that could be used for WUFTPD to respond to these
PASV requests. So instead of the default WUFTPD
behavior to pick any available port above 1024 at
random, it would be limited to the range I had 
defined. So only those ports would need to be
opened on my firewall.

 So these FTP clients could be coming in from
any IP address and I do want to allow any IP 
address. I just want to limit what ports WUFTPD
chooses from (to match my firewall) when a client
does send a PASV command.

 So presuming I dont mind limiting my internal
users to the same range of PASV ports, does that 
one line above do the trick for any possible client
IP?
	Thanx,
	Roger  

-----Original Message-----
From: Gregory A Lundberg [mailto:[email-masked]]
Sent: Thursday, January 07, 1999 7:08 AM
To: Roger Hanke
Cc: 'Bernhard Rosenkraenzer'; 'Roger A. Hanke'; 'WUFTPD List'
Subject: Re: BeroFTPD passive ports directive

On Wed, 6 Jan 1999, Roger Hanke wrote:

> Was hoping you could expand on how this network address specification
> was being used to match incoming client requests which at least in my
> case would always be directed against the same machine IP address.

passive address <externalip> <cidr>

	If a request comes *FROM* <cidr> lie by telling it the PASV port
	is listening on <externalip> instead of the machine's real IP.
	This supports NATs and other similar schemes where the machine IP
	we get by probing the interface isn't the IP the external client
	needs to know to connect to us.

passive ports <cidr> <min> <max>

	If a request comes *FROM* <cidr> only use ports in the range <min>
	to <max> for the PASV listening port.  This supports multiple
	gateways through different networks.

Consider (this isn't the way my network is set up, but it could be):

My network is 205.133.13.0/24 and I filter external requests to only
allow
ports 10000-12000 through for PASV FTP.  I don't filter internal
machines
and my FTP server has a real IP address.

I don't need 'passive address' since the address my machine reports will
work for everyone, but I need two 'passive ports' clauses:

passive ports 205.133.13.0/24 1024 65535
passive ports 0.0.0.0/0 10000 12000

Note I could use IP:mask specifications if I still though in those terms
as well:

passive ports 205.133.13.0:255.255.255.0 1024 65535
passive ports 0.0.0.0:0.0.0.0 10000 12000

Hmm .. looking at these examples, I see I need a better way to define
cases where I do NOT want the 'passive' clauses to take effect.  I'll
think about that for a future VR patch set; anyone have any ideas or
comments?

--