Subject: Another Followup

From: "marc " <[email-masked]>
Date: Mon, 3 Jul 2000 11:02:05 -0500

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Also, the following is in my logs:

Jul  3 10:44:56 <kern.info> olympus /kernel: Connection attempt to TCP 208.189.1
26.3:4172 from 205.188.247.193:20
Jul  3 10:45:00 <cron.info> olympus CRON[12521]: (root) CMD (/usr/libexec/atrun)

Jul  3 10:45:13 <local2.notice> olympus http-gw[12523]: permit host=athens.eisen
barth.org./148.104.2.222 use of gateway (V2.1)
Jul  3 10:45:13 <local2.notice> olympus http-gw[12523]: log host=athens.eisenbar
th.org./148.104.2.222 protocol=FTP cmd=dir dest=ftp.netscape.com path=/
Jul  3 10:45:17 <local2.notice> olympus http-gw[12523]: exit host=athens.eisenba
rth.org./148.104.2.222 cmds=1 in=0 out=0 user=unauth duration=4
Jul  3 10:45:17 <kern.info> olympus /kernel: Connection attempt to TCP 208.189.1
26.3:4176 from 205.188.247.194:20

It looks like the return TCP packets from the ftp server are using
unprivledged ports on my machine, and fwtk won't let them in... 
what do you guys think?

-Marc

---

From: Ted Keller <[email-masked]>
Date: Tue, 4 Jul 2000 08:16:23 -0400 (EDT)

Marc,

The ftp protocol calls for two channels to be opened.  The first is the
standard command channel (port 21).  It will use this channel to pass
basic comands between the client and the server.  When a data transfer is
requested (like the dir command your client issued), the client and server
(in our case the http proxy) "negotiate" to use a high number port for the
data transfer.  Normally port 20 (ftp-data) is not used - but some
negotiated high numbered port.  (in your example prot 4176).  If you have
these blocked such that the http-gw cannot open them up - then your ftp
transfers will fail.  Note - the same holds true for ftp-gw.

ted keller