Subject: wu-ftpd and firewalls

From: "Scott R. Every" <[email-masked]>
Date: Sun, 24 Jan 1999 01:44:36 -0500

I have a Borderware firewall and I am having all sorts of trouble getting hosts
on the inside of the firewall to connect to wu-ftpd servers.  I have tried beta
15, 16, 18 and the Beroftp server and all exhibit the same behavior:
15-30 seconds of deadtime before the connection is established.

I di NOT see this when ftp'ng to sunsite.unc.edu which appears to be using 
beta 13.

I have customers who have noted the same troubles with other firewalls.  The
firewalls seem to have no problems ftp'ng to the standard Solaris ftp daemon.

However, I have need of wu-ftpd's features.

I have looked at the faq and saw nothing related to firewalls.

Any help would be appreciated.

s 

--
Scott R. Every        "Everything is controlled by a small evil group to 
 EMJ Internet          which, unfortunately, no one we know belongs."
 voice : 1-800-548-2319  fax : 1-919-363-4423  mailto:[email-masked]
 WWW - http://www.emji.net   

Do you believe in Macintosh? Learn how to help the cause by 
subscribing to the "EvangeList" listserver! Send email to:
<[email-masked]> or go to: 
<http://www.lists.apple.com/>

---

From: Gregory A Lundberg <[email-masked]>
Date: Sun, 24 Jan 1999 11:06:03 -0500 (EST)

On Sun, 24 Jan 1999, Scott R. Every wrote:

> I have a Borderware firewall and I am having all sorts of trouble
> getting hosts on the inside of the firewall to connect to wu-ftpd
> servers.  I have tried beta 15, 16, 18 and the Beroftp server and all
> exhibit the same behavior: 15-30 seconds of deadtime before the
> connection is established.
> 
> I di NOT see this when ftp'ng to sunsite.unc.edu which appears to be
> using beta 13.
> 
> I have customers who have noted the same troubles with other
> firewalls.  The firewalls seem to have no problems ftp'ng to the
> standard Solaris ftp daemon.
> 

First guess, tell your firewall to allow AUTH protocol (RFC 931) outbound
TCP from your FTP server (any non-privileged port) to anywhere (port 113).
This will speed things up a bit.  You can disable RFC 931 in the daemon by
changing config.h to #undef USE_RFC931.

-- 

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: "Scott R. Every" <[email-masked]>
Date: Sun, 24 Jan 1999 13:28:55 -0500

Disbaling RFC931 on both Beroftpd 1.3.2 and 1.2.3 still resulted in delays of 
>10 seconds.  I also disabled DNS retrys which seemed to have no effect.

Any other ideas?

s