Re: ipfilter(4) needs maintainer

From: Kimmo Paasiala <kpaasial_at_gmail.com>
Date: Mon, 15 Apr 2013 13:54:48 +0300
On Mon, Apr 15, 2013 at 1:50 PM, Lev Serebryakov <lev_at_freebsd.org> wrote:
> Hello, Kimmo.
> You wrote 15 апреля 2013 г., 14:47:24:
>
> KP> I'm however talking about an ftp client behind a very restrictive
> KP> firewall making an IPv6 connection an ftp server that uses passive
> KP> mode data ports that can't be known in advance.
>   Same solution -- inspection of connections to 21 port, without any
>  address translation. And if FTP server uses non-standard control
>  port, yes, here is a problem, but it cannot be solved with NAT too
>  (or your NAT/firewall should expect each and every connection for FTP
>  commands, which is heavy and error-prone task).
>

Mmm, are you thinking of the way Linux iptables handles this scenario
with a kernel mode helper? I don't think any of the three packet
filters in FreeBSD has a functionality like that yet.

-Kimmo
Received on Mon Apr 15 2013 - 08:54:50 UTC

This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:40:36 UTC