From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Christian Gmeiner" Subject: Problem with connection-tracking and FTP Date: Tue, 20 Jan 2004 17:01:26 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: <002001c3df6e$a97416e0$0600a8c0@blackbox> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_001D_01C3DF77.0A7E7DB0" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------=_NextPart_000_001D_01C3DF77.0A7E7DB0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hi everybody. I am working on a little firewall script. Everything works just fine, = but i dont get the ftp protocoll working. I call this two function to get ftp working: # = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D FTP() { ebegin "Seting rules for active/passive FTP" # Port 21 iptables -A INPUT -p tcp --sport 21 -m state --state ESTABLISHED = -j ACCEPT=20 iptables -A OUTPUT -p tcp --dport 21 -m state --state = NEW,ESTABLISHED -j ACCEPT=20 # aktiv iptables -A INPUT -p tcp --sport 20 -m state --state = ESTABLISHED,RELATED -j ACCEPT=20 iptables -A OUTPUT -p tcp --dport 20 -m state --state ESTABLISHED -j = ACCEPT=20 # passiv iptables -A INPUT -p tcp --sport 1024: --dport 1024: -m state = --state ESTABLISHED -j ACCEPT=20 iptables -A OUTPUT -p tcp --sport 1024: --dport 1024: -m state = --state ESTABLISHED,RELATED -j ACCEPT=20 eend $? } # = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D loadmodules() { ebegin "Try to load needed modules" /sbin/modprobe ip_tables /sbin/modprobe iptable_filter /sbin/modprobe ip_conntrack /sbin/modprobe ip_conntrack_ftp /sbin/modprobe ipt_ULOG eend $? } An here my start function # = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D start()=20 { ebegin "Starting Firewall" loadmodules einfo "Setting default rules to drop" iptables -F iptables -X=20 iptables -Z=20 iptables -F INPUT iptables -F OUTPUT iptables -F FORWARD iptables -P FORWARD DROP iptables -P INPUT DROP iptables -P OUTPUT DROP acceptlocal portscan proc iana illigalpackages spoofing FTP # set rules InOutTCP InTCP OutTCP InOutUDP InUDP OutUDP # Erlaube dem Client routen durch NAT (Network Address Translation iptables -t nat -A POSTROUTING -o ${EXT_INT} -j MASQUERADE echo "1" > /proc/sys/net/ipv4/ip_forward eend $? "Failed to start Firewall" } And here are the ports i allow with the function InOut*, In*, Out*,... # TCP in+out # TCP_IN_OUT=3D"ssh 10000 smtp pop3 http https" # TCP out # # 5190 =3D ICQ # TCP_OUT=3D"5190 http https irc 25 ftp ftp-data" # TCP in # TCP_IN=3D"" # UDP in+out # UDP_IN_OUT=3D"domain ssh 10000 pop3 ssh" # UDP out # UDP_OUT=3D"https irc" # UDP in # UDP_IN=3D"" Oh and here some important functions: # = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D InOutTCP() { ebegin "Allowing in and outbound TCP-traffic" for i in ${TCP_IN_OUT} do einfo " <-> Seting TCP "in" and "out" rules for ${i}" iptables -A INPUT -j ACCEPT -i ${EXT_INT} -p tcp --dport ${i} = -m state --state NEW,ESTABLISHED,RELATED iptables -A OUTPUT -j ACCEPT -o ${EXT_INT} -p tcp --sport ${i} = --dport 1024: -m state --state ESTABLISHED,RELATED iptables -A FORWARD -j ACCEPT -i ${EXT_INT} -p tcp --dport ${i} = -m state --state NEW,ESTABLISHED,RELATED iptables -A FORWARD -j ACCEPT -o ${EXT_INT} -p tcp --sport ${i} = -m state --state ESTABLISHED,RELATED iptables -A OUTPUT -j ACCEPT -o ${EXT_INT} -p tcp --sport 1024: = --dport ${i} -m state --state NEW,ESTABLISHED,RELATED iptables -A INPUT -j ACCEPT -i ${EXT_INT} -p tcp --sport ${i} = -m state --state ESTABLISHED,RELATED iptables -A FORWARD -j ACCEPT -o ${EXT_INT} -p tcp -s ${LAN} = --sport 1024: --dport ${i} -m state --state NEW,ESTABLISHED,RELATED iptables -A FORWARD -j ACCEPT -i ${EXT_INT} -p tcp --sport ${i} = -d ${LAN} -m state --state ESTABLISHED,RELATED done eend $? } # = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=20 OutTCP() { ebegin "Allowing outbound TCP-traffic" for i in ${TCP_OUT} do einfo " <-> Seting TCP "out" rules for ${i}" iptables -A OUTPUT -j ACCEPT -o ${EXT_INT} -p tcp --sport 1024: = --dport $i -m state --state NEW,ESTABLISHED,RELATED iptables -A INPUT -j ACCEPT -i ${EXT_INT} -p tcp --sport $i -m = state --state ESTABLISHED,RELATED iptables -A FORWARD -j ACCEPT -o ${EXT_INT} -p tcp -s ${LAN} = --sport 1024: --dport $i -m state --state NEW,ESTABLISHED,RELATED iptables -A FORWARD -j ACCEPT -i ${EXT_INT} -p tcp --sport $i = -d ${LAN} -m state --state ESTABLISHED,RELATED done eend $? } I hope somebody can help me. Thanks, Christian Gmeiner ------=_NextPart_000_001D_01C3DF77.0A7E7DB0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Hi everybody.
 
I am working on a little firewall = script.=20 Everything works just fine, but i dont get the ftp protocoll=20 working.
 
I call this two function to get ftp=20 working:
 
#=20 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D
FTP()
{
    ebegin=20 "Seting rules for active/passive FTP"
 
    # Port = 21
 
    iptables -A=20 INPUT     -p tcp --sport 21 -m state --state = ESTABLISHED -j=20 ACCEPT
    iptables -A OUTPUT -p tcp --dport 21 -m = state=20 --state NEW,ESTABLISHED -j ACCEPT
 
    # = aktiv
   =20 iptables -A INPUT     -p tcp --sport 20 -m state = --state=20 ESTABLISHED,RELATED -j ACCEPT
    iptables -A OUTPUT = -p tcp=20 --dport 20 -m state --state ESTABLISHED -j ACCEPT
 
    # = passiv
   =20 iptables -A INPUT     -p tcp --sport 1024: --dport=20 1024:  -m state --state ESTABLISHED -j ACCEPT =
   =20 iptables -A OUTPUT -p tcp --sport 1024: --dport 1024:  -m state = --state=20 ESTABLISHED,RELATED -j ACCEPT
 
    eend = $?
}
 

#=20 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D
loadmodules()
{
   =20 ebegin "Try to load needed modules"
 
    /sbin/modprobe ip_tables
   =20 /sbin/modprobe iptable_filter
    /sbin/modprobe=20 ip_conntrack
    /sbin/modprobe=20 ip_conntrack_ftp
    /sbin/modprobe=20 ipt_ULOG
    eend $?
}
 
An here my start function
# = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D
start()
{
   =20 ebegin "Starting Firewall"
 
    loadmodules
 
    einfo "Setting default rules to=20 drop"
    iptables -F
    iptables = -X=20
    iptables -Z
    iptables -F=20 INPUT
    iptables -F OUTPUT
    = iptables -F=20 FORWARD
 
    iptables -P FORWARD DROP
    = iptables=20 -P INPUT   DROP
    iptables -P OUTPUT  = DROP
 
    acceptlocal
   =20 portscan
    proc
   =20 iana
    illigalpackages
   =20 spoofing
    FTP
 
    # set rules
   =20 InOutTCP
    InTCP
   =20 OutTCP
    InOutUDP
   =20 InUDP
    OutUDP
 
    # Erlaube dem Client routen durch NAT (Network = Address=20 Translation
    iptables -t nat -A POSTROUTING -o = ${EXT_INT}=20 -j MASQUERADE
    echo "1" >=20 /proc/sys/net/ipv4/ip_forward
 
    eend $? "Failed to start Firewall"
}
 
 
And here are the ports i allow with the function InOut*, In*,=20 Out*,...
 
# TCP in+out
#
TCP_IN_OUT=3D"ssh 10000 smtp pop3 http = https"
 
# TCP out
#
# 5190 =3D ICQ
#
TCP_OUT=3D"5190 http https = irc 25 ftp=20 ftp-data"
 
# TCP in
#
TCP_IN=3D""
 
# UDP in+out
#
UDP_IN_OUT=3D"domain ssh 10000 pop3 ssh"
 
# UDP out
#
UDP_OUT=3D"https irc"
 
# UDP in
#
UDP_IN=3D""
 
 
Oh and here some important functions:
 
#=20 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D
InOutTCP()
{
   =20 ebegin "Allowing in and outbound TCP-traffic"
 
    for i in ${TCP_IN_OUT}
   =20 do
        einfo "   = <->=20 Seting TCP "in" and "out" rules for ${i}"
 
        iptables -A INPUT  = -j=20 ACCEPT -i ${EXT_INT} -p tcp --dport ${i} -m state --state=20 NEW,ESTABLISHED,RELATED
        = iptables=20 -A OUTPUT -j ACCEPT -o ${EXT_INT} -p tcp --sport ${i} --dport 1024: -m = state=20 --state = ESTABLISHED,RELATED
       =20 iptables -A FORWARD  -j ACCEPT -i ${EXT_INT} -p tcp --dport ${i} -m = state=20 --state = NEW,ESTABLISHED,RELATED
       =20 iptables -A FORWARD -j ACCEPT -o ${EXT_INT} -p tcp --sport ${i} -m state = --state=20 ESTABLISHED,RELATED
 
        iptables -A OUTPUT -j = ACCEPT -o=20 ${EXT_INT} -p tcp --sport 1024: --dport ${i} -m state --state=20 NEW,ESTABLISHED,RELATED
        = iptables=20 -A INPUT  -j ACCEPT -i ${EXT_INT} -p tcp --sport ${i} -m state = --state=20 ESTABLISHED,RELATED
        = iptables -A=20 FORWARD -j ACCEPT -o ${EXT_INT} -p tcp -s ${LAN} --sport 1024: --dport = ${i} -m=20 state --state=20 NEW,ESTABLISHED,RELATED
        = iptables=20 -A FORWARD  -j ACCEPT -i ${EXT_INT} -p tcp --sport ${i} -d ${LAN} = -m state=20 --state ESTABLISHED,RELATED
    done
 
    eend $?
}
 
# = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=20
OutTCP()
{
    ebegin "Allowing outbound=20 TCP-traffic"
 
    for i in ${TCP_OUT}
   =20 do
        einfo "   = <->=20 Seting TCP "out" rules for ${i}"
 
        iptables -A OUTPUT -j = ACCEPT -o=20 ${EXT_INT} -p tcp --sport 1024: --dport $i -m state --state=20 NEW,ESTABLISHED,RELATED
        = iptables=20 -A INPUT  -j ACCEPT -i ${EXT_INT} -p tcp --sport $i -m state = --state=20 ESTABLISHED,RELATED
        = iptables -A=20 FORWARD -j ACCEPT -o ${EXT_INT} -p tcp -s ${LAN} --sport 1024: --dport = $i -m=20 state --state=20 NEW,ESTABLISHED,RELATED
        = iptables=20 -A FORWARD  -j ACCEPT -i ${EXT_INT} -p tcp --sport $i -d ${LAN} -m = state=20 --state ESTABLISHED,RELATED
    done
 
    eend $?
}
 
I hope somebody can help me.
 
Thanks, Christian Gmeiner
 
 
------=_NextPart_000_001D_01C3DF77.0A7E7DB0--