From owner-FreeBSD-net-jp@jp.freebsd.org  Thu Nov 16 22:27:26 2000
Received: (from daemon@localhost)
	by castle.jp.freebsd.org (8.9.3+3.2W/8.7.3) id WAA25636;
	Thu, 16 Nov 2000 22:27:26 +0900 (JST)
	(envelope-from owner-FreeBSD-net-jp@jp.FreeBSD.org)
Received: from sraigw.sra.co.jp (sraigw.sra.co.jp [202.32.10.2])
	by castle.jp.freebsd.org (8.9.3+3.2W/8.7.3) with ESMTP id WAA25630
	for <FreeBSD-net-jp@jp.freebsd.org>; Thu, 16 Nov 2000 22:27:25 +0900 (JST)
	(envelope-from soda@sra.co.jp)
Received: from sranhf.sra.co.jp (sranhf [133.137.28.3])
	by sraigw.sra.co.jp (8.8.7/3.7W-sraigw) with ESMTP id WAA24126
	for <FreeBSD-net-jp@jp.freebsd.org>; Thu, 16 Nov 2000 22:27:24 +0900 (JST)
Received: from srapc342.sra.co.jp (root@srapc342 [133.137.28.111])
	by sranhf.sra.co.jp (8.8.7/3.6Wbeta7-srambox) with ESMTP id WAA19981
	for <FreeBSD-net-jp@jp.freebsd.org>; Thu, 16 Nov 2000 22:27:22 +0900 (JST)
Received: (from soda@localhost) by srapc342.sra.co.jp (8.8.8/3.4W-sra) id WAA07127 for FreeBSD-net-jp@jp.freebsd.org; Thu, 16 Nov 2000 22:27:22 +0900 (JST)
Date: Thu, 16 Nov 2000 22:27:22 +0900 (JST)
From: Noriyuki Soda <soda@sra.co.jp>
Message-Id: <200011161327.WAA07127@srapc342.sra.co.jp>
To: FreeBSD-net-jp@jp.freebsd.org
Reply-To: FreeBSD-net-jp@jp.freebsd.org
Precedence: list
X-Distribute: distribute version 2.1 (Alpha) patchlevel 24e+000315
X-Sequence: FreeBSD-net-jp 2853
Subject: [FreeBSD-net-jp 2853] Re: ftp & ipfilter
Errors-To: owner-FreeBSD-net-jp@jp.freebsd.org
Sender: owner-FreeBSD-net-jp@jp.freebsd.org
X-Originator: soda@sra.co.jp

$B@P@n$5$s(B wrote:
> > man ftpd $B$K$h$k$H!"$@$$$?$$(B 49152-65535 $B$N%]!<%H$r;H$&$=$&$G$9!#(B
> 
> $B@h$N%a!<%k$G$9$,!"4V0c$C$F$O$$$^$;$s$,!"(B
> $B@5$7$/$O(Bsysctl$B$G@_Dj$5$l$F$$$k$h$&$G$9!#(B
> 
> net.inet.ip.portrange.hifirst: 49152
> net.inet.ip.portrange.hilast: 65535

FreeBSD $BIUB0$N(B ftpd $B$N>l9g$K$O!"$3$l$G@5$7$$$N$G$9$,!"(B
$B85%a!<%k$G$O(B wu-ftpd $B$rMxMQ$5$l$F$$$k$H$$$&$3$H$J$N$G!"(B
$B$3$NCM$O4X78$"$j$^$;$s!#(B
wu-ftpd $B$O!"(Bpassive $B$N%]!<%HHV9f$r%i%s%@%`$K3d$jEv$F$k$?$a!"(B
$BDL>o$N(B anonymous port $B$N<+F03d$jEv$F$N%a%+%K%:%`$r;H$o$J$$$+$i$G$9!#(B

$B=>$C$F(B wu-ftpd $B$N>l9g!">.Eg$5$s$,=q$+$l$F$$$kDL$j!"(Bftpaccess $B%U%!%$%k(B
$B$G(B "passvie ports" $B$r;XDj$7$F$d$kI,MW$,$"$j$^$9!#3N$+;XDj$7$J$$>l9g$N(B
wu-ftpd $B$N%G%U%)!<%k%H$O(B 1024$B!A(B65535 $B$@$C$?$H;W$$$^$9!#(B
(1024$B!A(B65535 $B$@$H!"$[$H$s$I(B filter $B$7$F$$$k0UL#$,$J$/$J$C$F$7$^$&$N$G!_(B)

$B>.Eg$5$s(B wrote:
>   $B$3$N$"$?$j$b;29M$K$J$k$+$H!#(B
> 
> <http://www.obfuscation.org/ipf/ipf-howto.txt>

ipfw $B$G$O$J$/(B ipfilter $B$r;H$&>l9g$K$O!"$3$NNc$K$"$k$h$&$K(B keep state
$B5!G=$r;H$&$H!"(Bpassive port $B$H$7$F5v$7$?HO0O$N%]!<%H$KBP$9$k%]!<%H!&(B
$B%9%-%c%s$b$"$kDxEY$OKI$0$3$H$,$G$-$k$&$h$&$K$J$j$^$9!#(B
(ipfw $B$N>l9g$b!":G6a$O!"$3$l$HF1Ey$J5!G=$,F~$C$?$s$G$7$?$C$1!)(B)
$BNc$K$"$k$h$&$J!V(Bflags S$B!W$h$j$b!"!V(Bflags S/SAFR$B!W$NJ}$,NI$$$+$b!#(B

$B$H$3$m$G!"$3$NNc$@$H(B ftp client $BB&$N(B (source) $B%]!<%HHV9f$K$O@)8B$r(B
$B$+$1$F$$$^$;$s$,!"(Bsource $B%]!<%H$r(B 1024$B!A(B65535 $B$K@)8B$9$k$h$&$J(B
filter rule $B$r@_Dj$7$?>l9g!"LdBj$,=P$k$h$&$J(B ftp client ($B$N(B OS) $B$O!"(B
$B$I$l$/$i$$B8:_$9$k$s$G$7$g$&!)(B
--
soda
