|
Hello,
My question is about ftp and ftp data
connections.
I know this subject has been heavily discussed but
still ...
I set up my firewall to allow connections to 21 and
20 ports.
I also allowed connections to high ports from
outside from port 20.
and of course I enabled all established and related
connections.
But when ever I connect to my ftp server and
issuing "ls" command it stacks.
In the firewall I see :
Feb 22 04:07:46 hostname IN=eth0 OUT=
MAC=00:e0:18:d3:1b:4b:00:90:5f:0d:64:38:08:00 SRC="" ip DST=my
server ip LEN=60 TOS=00 PREC=0x00 TTL=53 ID=41512 DF PROTO=TCP SPT=37070
DPT=21773 SEQ=3256137382 ACK=0 WINDOW=5648 SYN URGP=0
SPT=37070 DPT=21773 looks strange to
me.
It seems that ftp data session is trying to
establish connection from a high port to a high port.
SYN means that it trying to establish connection
and of course it is dropped by the firewall.
There is no sense in allowing anything from outside
to servers high ports.
I think that the client should issue a connect
request from a high port to servers 20 port.
And then it should match the established
connection.
What can be the problem ?
Thanks
|
