hi all...i have a webserver and i need to open ports for a ftp server (proftpd). But i cant...when i enter with my username/password and do a ls, i get this error:

here is my ipfw script:

Is this script correct? because when i run it, my ssh connection breaks

a tcp connection would require syn. it would first send a syn packet then recieve a syn+ack and so on.

so try removing the commands and check if ssh works properly

connections from only ${lib_ssh1} would allowed by this rule.

you could input an ftp rule
ipfw add 00026 pass tcp from any to me 21

i think that i dont explain quite well.

First of all, theres already on rule to open a ftp connection:
ipfw add 00048 pass tcp from ${lib_ftp} to me 21 keep-state setup

so i dont need to add your rule for ftp

And the problem with ssh is this: When i connect from my desktop to my Fbsd server and inside him i run this ipfw script....he breaks my ssh connection, maybe because the ipfw -f flush. Is there some way to solve this two problems?

Hi there;

<quote>
And the problem with ssh is this: When i connect from my desktop to my Fbsd server and inside him i run this ipfw script....he breaks my ssh connection, maybe because the ipfw -f flush.
</quote>

Yes, that's right, but it's not a problem. When you apply those rules your current ssh connection becomes blocked because it's not referenced in the newly-created state connection table. If you start a new connection it'll work fine. The only way for you to avoid this particular 'problem' would be to add a rule clearing out any traffic, from the trusted network to the ssh server regardless of connection state.
As for the ftp part pf the problem, the only thing that occurs to me is that your ftp client is not using passive mode... You could also modify your rule #49 to allow all ports from 1025 all the way to 65534, just in case...

Cheers

add a rule to clearing out? how?

Hi again;

I hope that 'clearing out' sounded like I intended it to... Being non-anglophon becomes a handicap at times... By 'clearing out' I mean't 'not being blocked'.
If ou remove the 'setup' keyword from your rule #26 then your ssh session won't be blocked when you activate the firewall.
But remember that the ssh connection being cut off when you apply the firewall rules really isn't a problem, it's just the firewall doing it's job. All you'd have to do would be to start a new ssh session and you'd be on again.

Cheers

yeah, but when i run the script over ssh conn, it cut my connection and the script doesnt finish to run...thats the problem

I think we're going around in circles here... :P
When the ssh connection gets cut, are you able to immediatly launch a new connection or not?

nops, because the script doesnt finish to run.

The "-f" switch should make it go all the way to the end. If you're logging the denied packets you can have a look at the log file and see what's going wrong.

Maybe you should start over with a simpler script? Perhaps leaving out those rules to avoid portscans and those tcpoptions?...

I'm out of ideas... No wait! You could use IPFILTER...!