RE: Firewall and FreeBSD ports

2008-10-13 Thread Bob McConnell
On Behalf Of RW I don't normally do this as Watson is usually less impressed when Holmes reveals his working, but the clues were there. He wrote: install software with ports (i.e, the /usr/ports collection.) and FTP to grab source files from mirrors If you combine that

Firewall and FreeBSD ports

2008-10-10 Thread John Almberg
I just set up a new server with a very restricted PF configuration. One problem: I can no longer install software with ports (i.e, the / usr/ports collection.) I have to disable PF to do so. Obviously not a great solution. Am I correct in guessing that ports uses FTP to grab source files

Re: Firewall and FreeBSD ports

2008-10-10 Thread Jeremy Chadwick
On Fri, Oct 10, 2008 at 12:45:04PM -0400, John Almberg wrote: I just set up a new server with a very restricted PF configuration. One problem: I can no longer install software with ports (i.e, the / usr/ports collection.) I have to disable PF to do so. Obviously not a great solution. Am

Re: Firewall and FreeBSD ports

2008-10-10 Thread RW
On Fri, 10 Oct 2008 09:51:16 -0700 Jeremy Chadwick [EMAIL PROTECTED] wrote: On Fri, Oct 10, 2008 at 12:45:04PM -0400, John Almberg wrote: I just set up a new server with a very restricted PF configuration. One problem: I can no longer install software with ports (i.e, the / usr/ports

Re: Firewall and FreeBSD ports

2008-10-10 Thread Jeremy Chadwick
On Fri, Oct 10, 2008 at 06:54:32PM +0100, RW wrote: On Fri, 10 Oct 2008 09:51:16 -0700 Jeremy Chadwick [EMAIL PROTECTED] wrote: On Fri, Oct 10, 2008 at 12:45:04PM -0400, John Almberg wrote: I just set up a new server with a very restricted PF configuration. One problem: I can no longer

Re: Firewall and FreeBSD ports

2008-10-10 Thread Wojciech Puchar
problem: I can no longer install software with ports (i.e, the /usr/ports collection.) I have to disable PF to do so. Obviously not a great solution. Am I correct in guessing that ports uses FTP to grab source files from FTP or HTTP. if you have http proxy like squid in your network do

Fwd: Firewall and FreeBSD ports

2008-10-10 Thread John Almberg
On Oct 10, 2008, at 2:41 PM, Jeremy Chadwick wrote: On Fri, Oct 10, 2008 at 06:54:32PM +0100, RW wrote: On Fri, 10 Oct 2008 09:51:16 -0700 Jeremy Chadwick [EMAIL PROTECTED] wrote: On Fri, Oct 10, 2008 at 12:45:04PM -0400, John Almberg wrote: I just set up a new server with a very restricted

Fwd: Firewall and FreeBSD ports

2008-10-10 Thread John Almberg
sh/bash: export FTP_PASSIVE_MODE=true Ah... because in passive mode, the client (my server) sets the data port, and my PF rules allow return data on the port used for the request. Okay... that makes sense, I think... (little by little, it sinks in...) -- John

Re: Firewall and FreeBSD ports

2008-10-10 Thread RW
On Fri, 10 Oct 2008 11:41:40 -0700 Jeremy Chadwick [EMAIL PROTECTED] wrote: On Fri, Oct 10, 2008 at 06:54:32PM +0100, RW wrote: On Fri, 10 Oct 2008 09:51:16 -0700 Jeremy Chadwick [EMAIL PROTECTED] wrote: passive ftp has been the default for long time, fetch is called with the -p option.

Re: Fwd: Firewall and FreeBSD ports

2008-10-10 Thread RW
On Fri, 10 Oct 2008 16:16:29 -0400 John Almberg [EMAIL PROTECTED] wrote: On Oct 10, 2008, at 2:41 PM, Jeremy Chadwick wrote: See the fetch(1) man page. Try this first: sh/bash: export FTP_PASSIVE_MODE=true csh: setenv FTP_PASSIVE_MODE true First off, this did solve the problem.

Re: Firewall and FreeBSD ports

2008-10-10 Thread John Almberg
sh/bash: export FTP_PASSIVE_MODE=true csh: setenv FTP_PASSIVE_MODE true First off, this did solve the problem. Thank you, Jeremy. Now, as to the why... That's odd, because if you are running 7.x with a default settings, FTP_PASSIVE_MODE should be irrelevant to fetching distfiles - even