(cc'ing this mail to a couple of LUG mailing lists...) hey all, spawned from a recent discussion on this mailing list (suse-security), i would like to ask the following question: in a NAT'd LAN, how can one enable the use of genuine ftp clients (ncftp, wsftp) as well as netscape/ie that pretend to speak ftp, without allowing all connections to ports 1024+ on the firewall/masquerading host? 99% of all ftp traffic nowadays is passive, so the data transfer happens from port 21 of the server to port x {x | x >= 1024} of the client. our firewall is implemented with ipchains (subject to change sometime), so it's stateless. blocking all ports above 1024 disables not only ftp but a lot of services such as ssh that make use of the ports 1024+ for the client connection. philip snizek suggested closing ports 5000 and up, leaving only some 4000 ports for this usage, but that solution is not what i am looking for because it still leaves 4000 ports open for an attack, and what is more important in this situation, it is very possible that some client program tries to establish a connection to a server with the backward connect (server -> client) being something like x -> 5021. in that case then, the connect will mysteriously fail (i DENY packets rather than to REJECT them). so while it is perfectly understandable to me how and why and what ports under 1024 i have to block and open to secure the machine, the ports above 1024 are a mystery. a lot of networks i have worked in/with/for had firewall policies that allowed anything above 1024, but as philip pointed out, this is asking for trojans. so i am wondering if, besides the installation of a statefull firewall, there is a way to secure the machine without affecting the liberty of the users in the LAN. and do you guys know of free, open-source statefull firewalls for linux? thanks, martin [greetings from the heart of the sun]# echo madduck@!#:1:s@\@@@.net -- echo '[dO%O+38%O+PO/d0<0]Fi22os0CC4BA64E418CE7l0xAP'|dc