All of lore.kernel.org
 help / color / mirror / Atom feed
* RE: Problem with passiv FTP
@ 2004-02-25 21:31 Daniel Chemko
  2004-02-25 21:56 ` Christian Gmeiner
  0 siblings, 1 reply; 3+ messages in thread
From: Daniel Chemko @ 2004-02-25 21:31 UTC (permalink / raw)
  To: Christian Gmeiner, netfilter


Run these shell commands at boot, or any time before you want FTP to
work properly
	modprobe ip_conntrack_ftp
	modprobe ip_nat_ftp

For the an FTP server on the firewall itself, use
	# Allow anyone to inbound to the FTP server
	iptables -A INPUT -p tcp --dport 21 -j ACCEPT
	# ALWAYS HAVE THIS RULE & FIRST IN LIST
	iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

For machines behind your firewall connecting to the internet, use
	# You should tighten up this rule a bit specifying -i
<internal_interface_address> as well as the following
	iptables -A FORWARD -p tcp --dport 21 -j ACCEPT
	# ALWAYS HAVE THIS RULE & FIRST IN LIST
	iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j
ACCEPT

For internet clients connecting to an internal server, use
	# This forwards the FTP request to the right internal FTP server
	iptables -t nat -A PREROUTING --destination
<external_ftp_address> -p tcp --dport 21 -j DNAT --to
<internal_ftp_server>
	# Allow traffic to DNAT'd IP address
	iptables -A FORWARD --destination <internal_ftp_server> -p tcp
--dport 21 -j ACCEPT
	# ALWAYS HAVE THIS RULE & FIRST IN LIST
	iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j
ACCEPT

That is all!

PS: Never fck around with OUTPUT unless you're a pro.
FORWARD goes through the firewall INPUT/OUTPUT are just for local
firewall PC connections.


Christian Gmeiner wrote:
> Hi people.
> 
> I got active FTP working, but i also need the passive one.
> 
> Here is my stuff:
> 
>     # Port 21
> 
>     iptables -A INPUT     -p tcp --sport 21 -m state --state
>     ESTABLISHED -j ACCEPT iptables -A OUTPUT -p tcp --dport 21 -m
> state --state NEW,ESTABLISHED -j ACCEPT 
> 
>     # aktiv - works
>     iptables -A INPUT     -p tcp --sport 20 -m state --state
>     ESTABLISHED,RELATED -j ACCEPT iptables -A OUTPUT -p tcp --dport
> 20 -m state --state ESTABLISHED -j ACCEPT 
> 
>     # passiv
>     iptables -A INPUT     -p tcp --sport ${UNPRIVPORTS} --dport
>     ${UNPRIVPORTS}  -m state --state ESTABLISHED -j ACCEPT iptables
> -A OUTPUT -p tcp --sport ${UNPRIVPORTS} --dport ${UNPRIVPORTS}  -m
> state --state ESTABLISHED,RELATED -j ACCEPT  
> 
> I have everything set to drop and i am alowing this protocols and
> ports: 
> 
> # TCP in+out
> #
> #
> TCP_IN_OUT="ssh"
> 
> # TCP out
> #
> # 5190 = ICQ
> #
> TCP_OUT="5190 http https 25 ftp ftp-data pop3 smtp"
> 
> # TCP in
> #
> TCP_IN=""
> 
> # UDP in+out
> #
> UDP_IN_OUT="domain ssh"
> 
> # UDP out
> #
> #
> UDP_OUT="https"
> 
> # UDP in
> #
> UDP_IN=""
> 
> UNPRIVPORTS="1024:65535"
> 
> So.. i must now allow the UNPRIVPORTS, but how i am doing this?
> 
> Thanks, Christian Gmeiner


^ permalink raw reply	[flat|nested] 3+ messages in thread
* Problem with passiv FTP
@ 2004-02-25 21:00 Christian Gmeiner
  0 siblings, 0 replies; 3+ messages in thread
From: Christian Gmeiner @ 2004-02-25 21:00 UTC (permalink / raw)
  To: netfilter

[-- Attachment #1: Type: text/plain, Size: 1202 bytes --]

Hi people.

I got active FTP working, but i also need the passive one.

Here is my stuff:

    # Port 21

    iptables -A INPUT     -p tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT 
    iptables -A OUTPUT -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT 

    # aktiv - works
    iptables -A INPUT     -p tcp --sport 20 -m state --state ESTABLISHED,RELATED -j ACCEPT 
    iptables -A OUTPUT -p tcp --dport 20 -m state --state ESTABLISHED -j ACCEPT 

    # passiv
    iptables -A INPUT     -p tcp --sport ${UNPRIVPORTS} --dport ${UNPRIVPORTS}  -m state --state ESTABLISHED -j ACCEPT 
    iptables -A OUTPUT -p tcp --sport ${UNPRIVPORTS} --dport ${UNPRIVPORTS}  -m state --state ESTABLISHED,RELATED -j ACCEPT 

I have everything set to drop and i am alowing this protocols and ports:

# TCP in+out
#
#
TCP_IN_OUT="ssh"

# TCP out
#
# 5190 = ICQ
#
TCP_OUT="5190 http https 25 ftp ftp-data pop3 smtp"

# TCP in
#
TCP_IN=""

# UDP in+out
#
UDP_IN_OUT="domain ssh"

# UDP out
#
#
UDP_OUT="https"

# UDP in
#
UDP_IN=""

UNPRIVPORTS="1024:65535"

So.. i must now allow the UNPRIVPORTS, but how i am doing this?

Thanks, Christian Gmeiner

[-- Attachment #2: Type: text/html, Size: 3147 bytes --]

^ permalink raw reply	[flat|nested] 3+ messages in thread
end of thread, other threads:[~2004-02-25 21:56 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2004-02-25 21:31 Problem with passiv FTP Daniel Chemko
2004-02-25 21:56 ` Christian Gmeiner
  -- strict thread matches above, loose matches on Subject: below --
2004-02-25 21:00 Christian Gmeiner

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.