The following output filter will keep anyone connecting to the ftp,
telnet, and http ports (which someone else asked for) on the dial-in
user's host, but allow any other kind of access. Note that a clever
user can change the ports these services listen on.
add filter noftp.out
set filter noftp.out 1 permit tcp established
set filter noftp.out 2 deny tcp dst eq 21
set filter noftp.out 3 deny tcp dst eq 23
set filter noftp.out 4 deny tcp dst eq 80
set filter noftp.out 5 permit
save all
In the RADIUS entry for that noftp, include the attribute
Filter-Id = "noftp"
(RADIUS 1.16 calls this Framed-Filter-Id instead of Filter-Id.)
The PortMaster will look for noftp.in as an input filter (and not find
it) and look for noftp.out as an output filter, and apply that to the
interface it creates for the dial-in user. All packets to be sent out
on that interface (from the PortMaster to the user) will first go
through the filter.
-- Carl Rigney cdr@livingston.com