🚀 go-pugleaf

I want to limit exchanges between two networks to a limited set of services
(say telnet and ftp, both ways).  I need to prevent unwarranted connection
requests from the outside to anything except those services.  The simplest way
would have been to do the filtering in the following order

	 - allow connections requests to ports 21,23

	 - allow connections requests coming from a remote port 20 to
	   unpriviledged ports (so ftp can open a data channel -- in a typical
	   ftp exchange the requestor would have a port 3285 (say) connecting
	   to port 21, and on a "get" a data channel from the ftp server's
	   port 20 to the requestor's port 3286 (say) would be open).

	 - allow *established* connections to any port
	 
Now from what I see cisco somewhat inexplicably only allows filtering on 3 of
the 4 parameters of a tcp connection (i.e. there is no way to say: allow
packets from port 20 on machine 132.220.99.4 to go to any port >1023 on net
142.91 -- I'm assuming here that port 20 on 132.220.99.4 cannot be trivially
stolen).

So I'm back to allowing ports > 1023 from a single specific machine and adding
explicit deny clauses for services I happen to know are there in the net I'm
trying to shelter, which is a real mess (consider for example terminal servers
listening on printer ports, unix machines with daemons listening on port
2201), etc.

This goes exactly against what I was trying to acheive.  Is there any way to
only allow ftp and telnet requests between two nets?

Please reply by e-mail as I'd hate to lose answers on this one should I have
to skip news for a couple days and have valuable bits of wisdom expire on me.
I shall summarize.

Jean-Francois Lamy                                        |   lamy@sobeco.com
Research and Development, Computer Networks and Systems   |   lamy@sobeco.ca
Sobeco Ernst & Young, Montreal, Canada H2Z 1Y7            |   uunet!sobeco!lamy