filter to permit ftp not working 100%

Craig Brenizer (craig@ouhsd.k12.ca.us)
Sun, 22 Dec 1996 20:47:11 -0800

I am building a filter, but cannot get it to work exactly as I need.

I have a PM2e and I want to give my dialup ppp users access
to *only*:
1. our web server
2. our mail server
3. our ftp server (which is same computer as web server)

THat's it, no more.

I have a filter in place (ftp.in & ftp.out) and it works almost 100%
When user dials in, they get:
1 full access to our web server
2. full access to our mail server
3. full access to our ftp server *if* they use an ftp client!

If they try to get files from ftp server using web browser, it doesn't
happen.

The browser gives message that it is contacting server, then
connected to server, but nothing ever gets transmitted until I
get bored and stop it (about 1 min.)

I think the problem lies in the port address portion of the filter.

I am not sure if web browsers use port 21 for ftp connections.

I have copied my filter from the PM for your scrutiny.

If anyone can see where the error lies, please let me know.

===== ftp.in =====

1 permit 0.0.0.0/0 0.0.0.0/0 udp dst eq 53
2 permit 0.0.0.0/0 0.0.0.0/0 udp src eq 53
3 permit 0.0.0.0/0 0.0.0.0/0 tcp src eq 21 estab
4 permit 0.0.0.0/0 0.0.0.0/0 tcp src eq 20 dst gt 1023
5 permit 0.0.0.0/0 198.188.25.188/32 tcp dst eq 21
6 permit 0.0.0.0/0 198.188.25.188/32 tcp dst eq 20 estab
7 permit 0.0.0.0/0 198.188.25.201/32 tcp dst eq 110
8 permit 0.0.0.0/0 198.188.25.201/32 tcp src eq 110 estab
9 permit 0.0.0.0/0 198.188.25.201/32 udp dst eq 110
10 permit 198.188.25.201/32 0.0.0.0/0 udp src eq 110 estab
11 permit 0.0.0.0/0 198.188.25.188/32 tcp dst eq 80
12 permit 0.0.0.0/0 198.188.25.188/32 tcp src eq 80 estab
13 permit 0.0.0.0/0 198.188.25.188/32 udp dst eq 80
14 permit 198.188.25.188/32 0.0.0.0/0 udp src eq 80 estab

===== ftp.out ======

1 permit 0.0.0.0/0 0.0.0.0/0 udp dst eq 53
2 permit 0.0.0.0/0 0.0.0.0/0 udp src eq 53
3 permit 0.0.0.0/0 0.0.0.0/0 tcp dst eq 21
4 permit 0.0.0.0/0 0.0.0.0/0 tcp dst eq 20
5 permit 198.188.25.188/32 0.0.0.0/0 tcp src eq 21 estab
6 permit 198.188.25.188/32 0.0.0.0/0 tcp src eq 20
7 permit 198.188.25.201/32 0.0.0.0/0 tcp src eq 110 estab
8 permit 198.188.25.201/32 0.0.0.0/0 tcp dst eq 110
9 permit 0.0.0.0/0 198.188.25.201/32 udp src eq 110 estab
10 permit 198.188.25.201/32 0.0.0.0/0 udp dst eq 110
11 permit 198.188.25.188/32 0.0.0.0/0 tcp src eq 80 estab
12 permit 198.188.25.188/32 0.0.0.0/0 tcp dst eq 80
13 permit 0.0.0.0/0 198.188.25.201/32 udp src eq 80 estab
14 permit 198.188.25.188/32 0.0.0.0/0 udp dst eq 80