From mboxrd@z Thu Jan 1 00:00:00 1970 From: Pascal Hambourg Subject: Re: FTP connection tracking doesn't work with nftables Date: Sun, 17 May 2015 22:59:58 +0200 Message-ID: <5559014E.7070803@plouf.fr.eu.org> References: <55589864.2010008@plouf.fr.eu.org> Mime-Version: 1.0 Content-Transfer-Encoding: QUOTED-PRINTABLE Return-path: In-Reply-To: Sender: netfilter-owner@vger.kernel.org List-ID: Content-Type: text/plain; charset="iso-8859-1" To: Tomek L Cc: netfilter@vger.kernel.org Tomek L a =E9crit : > I agree on source port issue, but I don't think that in case of TLS > there is nothing that can be done with FTP helper. Still we can assum= e > that just after TLS AUTH negotiation, client will connect on high por= t > with new connection to server. Now we are in situation, where if TLS > is used, high ports on server side must be open all the time. IMO, it is not much better to open all passive ports to any host which has established a connection to port 21 regardless of whether a PASV/EPSV command was acknowledged by the server.