allowing passive FTP with ipfw

hello

this is not working for allowing passive FTP on FreeBSD using ipfw

add allow tcp from any to me established
add check-state
add pass tcp from any 1024-65535 to me 21 setup keep-state via rl0
add pass tcp from me 20 to any 1024-65535 setup keep-state via rl0
my thought was to make it like:

add allow tcp from any to me established
add pass tcp from any 1024-65535 to me 21 setup via rl0
add pass tcp from me 20 to any 1024-65535 setup via rl0
so without the keep-state it should just check the sender IP and my server IP:port
but it still doesn't work...
probably because passive FTP will need to connect to another port on my server, so if it checks for "my server IP:port" it won't match

any suggestion different from "add pass tcp from any 1024-65535 to any 1024-65535"?

 

 

 

 

Top