conduit permit command

[jkaufman]

Is there a difference between "conduit permit tcp host x.x.x.x any eq www" and conduit permit tcp host x.x.x.x eq

http://www any"?

I've had instances where one works and the other doesn't and one case recently where term svcs (port 3389) needed both before access was granted from outside.

 

[themut]

conduit permit tcp host x.x.x.x any eq www"
You are saying anyone can come on port 80 only to host x.x.x.x who's listening on any port

conduit permit tcp host x.x.x.x eq

http://www any

You are saying anyone can come on any port to host x.x.x.x who's listening on port 80 only.

 

[jkaufman]

That was my understanding too...but then shouldn't either conduit work in almost all instances?

 

[themut]

Nope because clients use dynamic ports above 1024 while servers usually listen on fixed ports below 1024. For your internal servers you should use the later one.