Request for help: Debian firewall, and maybe some kernel upgradetips

[Brad]

> Correct me if I'm wrong, but the simple firewall rules
> posted earlier would effectively break ftp. Wouldn't
> the  unpriviledged ports also be blocked? Wouldn't you
> need to specifically allow the unpriviledged ports for
> either active or passive ftp? Wouldn't you need to
> allow outbound ports also? I don't remember all the
> rules posted, but I would think that the default rule
> would be to drop inbound and outbound unused ports. 
> 
> Brian D.

The default policy for the Output chain is usually ACCEPT, so there is
no need to open outbound ports specifically.  The ACCEPT statement on
the ESTABLISHED,RELATED line will allow connections to the unprivileged
ports since they are related to the connection on port 21.  I believe
ip_conntrack_ftp helps with this.

Brad