On Tue, 4 Apr 2000, Craig White wrote: > Besides the xfs - has anyone ever experienced attacks at the higher numbered > ports? The X-ports on 6000-6009 are fun targets :). Saw 6010 used for something as well, but don't know of any attempts against it. > The reason that I am asking is if block the ports 1024:65536 using ipchains > > something like... > ipchains -A input -j ACCEPT ! -y -p tcp -s 0/0 -d $extIP 1024:65536 You could just drop the last port off as ipchains assume 65535 and apparently there isn't a port 65536 :). I like that in the hope that the blank represents maximal ports as opposed to being hard-coded to 65535. > which only allows return packets in the high ranges and then people using > Netscape for a PASV ftp connection are rejected by a rule further down that > specific rejects that which is not specifically allowed. Not really certain where PASV ftp and all comes into this. If you're wanting to allow PASV ftp, then allow return packets to tcp port 21 and include the ip_masq_ftp module in your kernel. Allowing incoming connections on port 20 in conjunction with masquerading should enable active ftp as well. This should get things like SuSE's net update functionality of yast working. > Can I force them to use a specific port via html? > > i.e.