hubix wrote:
The connection success, but for the LIST ftp command, my firewall block packets with source and destination ports above 1024... Does anyone know why ftp protocol don't use 20 an 21 ports for this command, and how to configure my firewall to accept this packets without breaking it ?
FTP protocol tries first to set up as passive, with both parts using ports >1024. iptables handles this well, by just setting up connection tracking the good way. If you want ftp transfer in both directions, it seems you will have to accept ESTABLISHED,RELATED on tcp for both 20,21 destinated connections and >1024.
It should be fairly secure if you restrict well combination of TCP flags and connection initiating sequence. Friendly, Jerome
Attachment:
signature.asc
Description: OpenPGP digital signature