Firewall – How to detect from client which ports are being blocked

Here's the thing: Whether in Active or Passive mode, the server always uses port 20 on it's side for the data connection and connects to the client on whatever port the client specified when it issued the FTP PORT command.

After looking at the Windows 7 firewall it looks like you can create a custom inbound rule that allows connections to any local port from a specific remote port (20) for a given protocol type (TCP). You can also specify the local and remote ip addresses that this rule applies to.

I have to admit that I've never monkeyed around with the Windows firewall but it looks to me like it might work for you.

Here are the ports and protocols:

• Protocol: UDP, port 500 (for IKE, to manage encryption keys)
• Protocol: UDP, port 4500 (for IPSEC NAT-Traversal mode)
• Protocol: ESP, value 50 (for IPSEC)
• Protocol: AH, value 51 (for IPSEC)

Also, Port 1701 is used by the L2TP Server, but connections should not be allowed inbound to it from outside. There is a special firewall rule to allow only IPSEC secured traffic inbound on this port.

If using IPTABLES, and your L2TP server sits directly on the internet, then the rules you need are:

iptables -A INPUT -i $EXT_NIC -p udp --dport 500 -j ACCEPT
iptables -A INPUT -i $EXT_NIC -p udp --dport 4500 -j ACCEPT
iptables -A INPUT -i $EXT_NIC -p 50 -j ACCEPT
iptables -A INPUT -i $EXT_NIC -p 51 -j ACCEPT
iptables -A INPUT -i $EXT_NIC -p udp -m policy --dir in --pol ipsec -m udp --dport 1701 -j ACCEPT

Where $EXT_NIC is your external network interface card name, e.g. ppp0.