ipfilter (ipf) and active FTP clients

[Brian McEntire]

Can someone recommend rules to allow active FTP to succeed on an HP-UX 11i server?

I've already set:

pass out quick proto tcp from any to any keep state

But that only allows passive FTP. I have scripts that need active FTP.

[Steven E. Protter]

How does this work?

pass in quick tun0 proto tcp from any to port = 21
pass out quick on tun0 proto tcp from = 21 to any

I'm a novice with ip filter, but have a few good manuals around.

SEP

[Brian McEntire]

The problem seems to be with port 20 (ftp-data) on the remote end trying to open a connection back the host running the active FTP client and ipfilter.

When I FTP to a remote site, I can connect and authenticate fine. Then I type 'ls' and the FTP session just hangs.

ipmon on running on the same host as the active ftp client says it blocked this:

21/08/2003 18:26:55.118716 lan0 @0:15 b ,20 -> ,49460 PR tcp len 20 60 -S IN