From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Mark E. Donaldson" Subject: RE: Problem with connection-tracking and FTP Date: Wed, 21 Jan 2004 18:12:57 -0800 Sender: netfilter-admin@lists.netfilter.org Message-ID: <200401220212.i0M2CnlB028602@server5.bandwidthco.com> References: <001801c3e015$d6a86100$0600a8c0@blackbox> Reply-To: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0000_01C3E04A.32A5BC30" Return-path: In-Reply-To: <001801c3e015$d6a86100$0600a8c0@blackbox> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: 'Christian Gmeiner' , netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------=_NextPart_000_0000_01C3E04A.32A5BC30 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Yes. That would help. Also do an lsmod to make sure all of the needed modules are loaded. _____ From: Christian Gmeiner [mailto:christian@visual-page.de] Sent: Wednesday, January 21, 2004 3:58 AM To: markee@bandwidthco.com; netfilter@lists.netfilter.org Subject: Re: Problem with connection-tracking and FTP Thanks... I have now used your rule set: # CONTROL PORT (Active & Passive Mode) iptables -A INPUT -i ${EXT_INT} -p tcp --source-port ${UNPRIVPORTS} --destination-port 21 -m state --state NEW -j LOG --log-prefix "FTP ACCESS -> " iptables -A INPUT -i ${EXT_INT} -p tcp --source-port ${UNPRIVPORTS} --destination-port 21 -m state --state NEW -j ACCEPT # DATA PORT (Active Mode) iptables -A OUTPUT -o ${EXT_INT} -p tcp --source-port 20 --destination-port ${UNPRIVPORTS} -m state --state NEW -j LOG --log-prefix "FTP A-DATA -> " iptables -A OUTPUT -o ${EXT_INT} -p tcp --source-port 20 --destination-port ${UNPRIVPORTS} -m state --state NEW -j ACCEPT # DATA PORT (Passive Mode) iptables -A INPUT -i ${EXT_INT} -p tcp --source-port ${UNPRIVPORTS} --destination-port ${UNPRIVPORTS} -m state --state NEW -j LOG --log-prefix "FTP P-DATA -> " iptables -A INPUT -i ${EXT_INT} -p tcp --source-port ${UNPRIVPORTS} --destination-port ${UNPRIVPORTS} -m state --state NEW -j ACCEPT I can connect to the FTP-Server and login... but then wehen the directory listening should come it hangs. I have no idea, why this is so. Should i post the output of 'iptables -L -n -v --line-numbers'? Thanks, Christian Gmeiner ----- Original Message ----- From: Mark E. Donaldson To: 'Christian Gmeiner' ; netfilter@lists.netfilter.org Sent: Wednesday, January 21, 2004 6:32 AM Subject: RE: Problem with connection-tracking and FTP It would appear you are assuming the FTP server will choose port 1024 for passive mode ftp. This is not correct, as it may choose any unprivileged port up to 65535. That is one problem you are having. Also, check your syntax for "passive mode". You have made an error with some not needed colons (:). Here is a good rule set that will permit all ftp operations - active and passive: ###################### # FTP SERVICES ###################### UNPRIVPORTS="1024:65535" # CONTROL PORT (Active & Passive Mode) $IPT -t filter -A TCP_RULES -i $FW_INET_IFACE -p tcp --source-port $UNPRIVPORTS --destination-port 21 -m state --state NEW -j LOG --log-level $LOG_LEVEL --log-prefix "FTP ACCESS -> " $IPT -t filter -A TCP_RULES -i $FW_INET_IFACE -p tcp --source-port $UNPRIVPORTS --destination-port 21 -m state --state NEW -j ACCEPT # DATA PORT (Active Mode) $IPT -t filter -A TCP_RULES -o $FW_INET_IFACE -p tcp --source-port 20 --destination-port $UNPRIVPORTS -m state --state NEW -j LOG --log-level $LOG_LEVEL --log-prefix "FTP A-DATA -> " $IPT -t filter -A TCP_RULES -o $FW_INET_IFACE -p tcp --source-port 20 --destination-port $UNPRIVPORTS -m state --state NEW -j ACCEPT # DATA PORT (Passive Mode) $IPT -t filter -A TCP_RULES -i $FW_INET_IFACE -p tcp --source-port $UNPRIVPORTS --destination-port $UNPRIVPORTS -m state --state NEW -j LOG --log-level $LOG_LEVEL --log-prefix "FTP P-DATA -> " $IPT -t filter -A TCP_RULES -i $FW_INET_IFACE -p tcp --source-port $UNPRIVPORTS --destination-port $UNPRIVPORTS -m state --state NEW -j ACCEPT _____ From: netfilter-admin@lists.netfilter.org [mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Christian Gmeiner Sent: Tuesday, January 20, 2004 8:01 AM To: netfilter@lists.netfilter.org Subject: Problem with connection-tracking and FTP Hi everybody. I am working on a little firewall script. Everything works just fine, but i dont get the ftp protocoll working. I call this two function to get ftp working: # ================================== FTP() { ebegin "Seting rules for active/passive FTP" # Port 21 iptables -A INPUT -p tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT iptables -A OUTPUT -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT # aktiv iptables -A INPUT -p tcp --sport 20 -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A OUTPUT -p tcp --dport 20 -m state --state ESTABLISHED -j ACCEPT # passiv iptables -A INPUT -p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED -j ACCEPT iptables -A OUTPUT -p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED,RELATED -j ACCEPT eend $? } # ================================== loadmodules() { ebegin "Try to load needed modules" /sbin/modprobe ip_tables /sbin/modprobe iptable_filter /sbin/modprobe ip_conntrack /sbin/modprobe ip_conntrack_ftp /sbin/modprobe ipt_ULOG eend $? } An here my start function # ================================== start() { ebegin "Starting Firewall" loadmodules einfo "Setting default rules to drop" iptables -F iptables -X iptables -Z iptables -F INPUT iptables -F OUTPUT iptables -F FORWARD iptables -P FORWARD DROP iptables -P INPUT DROP iptables -P OUTPUT DROP acceptlocal portscan proc iana illigalpackages spoofing FTP # set rules InOutTCP InTCP OutTCP InOutUDP InUDP OutUDP # Erlaube dem Client routen durch NAT (Network Address Translation iptables -t nat -A POSTROUTING -o ${EXT_INT} -j MASQUERADE echo "1" > /proc/sys/net/ipv4/ip_forward eend $? "Failed to start Firewall" } And here are the ports i allow with the function InOut*, In*, Out*,... # TCP in+out # TCP_IN_OUT="ssh 10000 smtp pop3 http https" # TCP out # # 5190 = ICQ # TCP_OUT="5190 http https irc 25 ftp ftp-data" # TCP in # TCP_IN="" # UDP in+out # UDP_IN_OUT="domain ssh 10000 pop3 ssh" # UDP out # UDP_OUT="https irc" # UDP in # UDP_IN="" Oh and here some important functions: # ================================== InOutTCP() { ebegin "Allowing in and outbound TCP-traffic" for i in ${TCP_IN_OUT} do einfo " <-> Seting TCP "in" and "out" rules for ${i}" iptables -A INPUT -j ACCEPT -i ${EXT_INT} -p tcp --dport ${i} -m state --state NEW,ESTABLISHED,RELATED iptables -A OUTPUT -j ACCEPT -o ${EXT_INT} -p tcp --sport ${i} --dport 1024: -m state --state ESTABLISHED,RELATED iptables -A FORWARD -j ACCEPT -i ${EXT_INT} -p tcp --dport ${i} -m state --state NEW,ESTABLISHED,RELATED iptables -A FORWARD -j ACCEPT -o ${EXT_INT} -p tcp --sport ${i} -m state --state ESTABLISHED,RELATED iptables -A OUTPUT -j ACCEPT -o ${EXT_INT} -p tcp --sport 1024: --dport ${i} -m state --state NEW,ESTABLISHED,RELATED iptables -A INPUT -j ACCEPT -i ${EXT_INT} -p tcp --sport ${i} -m state --state ESTABLISHED,RELATED iptables -A FORWARD -j ACCEPT -o ${EXT_INT} -p tcp -s ${LAN} --sport 1024: --dport ${i} -m state --state NEW,ESTABLISHED,RELATED iptables -A FORWARD -j ACCEPT -i ${EXT_INT} -p tcp --sport ${i} -d ${LAN} -m state --state ESTABLISHED,RELATED done eend $? } # ================================== OutTCP() { ebegin "Allowing outbound TCP-traffic" for i in ${TCP_OUT} do einfo " <-> Seting TCP "out" rules for ${i}" iptables -A OUTPUT -j ACCEPT -o ${EXT_INT} -p tcp --sport 1024: --dport $i -m state --state NEW,ESTABLISHED,RELATED iptables -A INPUT -j ACCEPT -i ${EXT_INT} -p tcp --sport $i -m state --state ESTABLISHED,RELATED iptables -A FORWARD -j ACCEPT -o ${EXT_INT} -p tcp -s ${LAN} --sport 1024: --dport $i -m state --state NEW,ESTABLISHED,RELATED iptables -A FORWARD -j ACCEPT -i ${EXT_INT} -p tcp --sport $i -d ${LAN} -m state --state ESTABLISHED,RELATED done eend $? } I hope somebody can help me. Thanks, Christian Gmeiner ------=_NextPart_000_0000_01C3E04A.32A5BC30 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable
Yes.  That would help.  Also do an = lsmod to make=20 sure all of the needed modules are loaded.

From: Christian Gmeiner=20 [mailto:christian@visual-page.de]
Sent: Wednesday, January = 21, 2004=20 3:58 AM
To: markee@bandwidthco.com;=20 netfilter@lists.netfilter.org
Subject: Re: Problem with=20 connection-tracking and FTP

Thanks... I have now used your rule=20 set:
 
    # CONTROL PORT = (Active &=20 Passive Mode)
    iptables -A INPUT -i ${EXT_INT} -p = tcp=20 --source-port ${UNPRIVPORTS} --destination-port 21 -m state --state NEW = -j LOG=20 --log-prefix "FTP ACCESS -> "
    iptables -A INPUT = -i=20 ${EXT_INT} -p tcp --source-port ${UNPRIVPORTS} --destination-port 21 -m = state=20 --state NEW -j ACCEPT
 
    # DATA PORT = (Active=20 Mode)
    iptables -A OUTPUT -o ${EXT_INT} -p tcp=20 --source-port 20 --destination-port ${UNPRIVPORTS} -m state --state NEW = -j=20 LOG  --log-prefix "FTP A-DATA -> "
    = iptables -A=20 OUTPUT -o ${EXT_INT} -p tcp --source-port 20 --destination-port = ${UNPRIVPORTS}=20 -m state --state NEW -j ACCEPT
 
    # DATA = PORT=20 (Passive Mode)
    iptables -A INPUT -i ${EXT_INT} -p = tcp=20 --source-port ${UNPRIVPORTS} --destination-port ${UNPRIVPORTS} -m state = --state=20 NEW -j LOG --log-prefix "FTP P-DATA -> "
    = iptables -A=20 INPUT -i ${EXT_INT} -p tcp --source-port ${UNPRIVPORTS} = --destination-port=20 ${UNPRIVPORTS} -m state --state NEW -j ACCEPT
 
I can connect to the FTP-Server and = login... but=20 then wehen the directory listening should come it hangs. I have no idea, = why=20 this is so.
Should i post the output = of 'iptables -L -n -v=20 --line-numbers'?
 
Thanks, Christian Gmeiner
 
----- Original Message -----
From:=20 Mark E.=20 Donaldson
To: 'Christian Gmeiner' ; netfilter@lists.netfilter.o= rg=20
Sent: Wednesday, January 21, = 2004 6:32=20 AM
Subject: RE: Problem with=20 connection-tracking and FTP

It would appear you are assuming the FTP = server will=20 choose port 1024 for passive mode ftp.  This is not correct, as = it may=20 choose any unprivileged port up to 65535.  That is one problem = you are=20 having.  Also, check your syntax for "passive mode".  You = have made=20 an error with some not needed colons (:).
Here is a good rule set that will permit = all ftp=20 operations - active and passive:
 
######################
# FTP=20 SERVICES
######################
UNPRIVPORTS=3D"1024:65535"
 
# CONTROL PORT=20 (Active & Passive Mode)
$IPT -t filter=20 -A TCP_RULES -i $FW_INET_IFACE -p tcp --source-port $UNPRIVPORTS=20 --destination-port 21 -m state --state NEW -j LOG --log-level = $LOG_LEVEL=20 --log-prefix "FTP ACCESS -> "
$IPT -t filter=20 -A TCP_RULES -i $FW_INET_IFACE -p tcp --source-port $UNPRIVPORTS=20 --destination-port 21 -m state --state NEW -j ACCEPT
 
# DATA PORT=20 (Active Mode)
$IPT -t filter -A TCP_RULES -o $FW_INET_IFACE -p tcp=20 --source-port 20 --destination-port $UNPRIVPORTS -m state --state NEW = -j LOG=20 --log-level $LOG_LEVEL --log-prefix "FTP A-DATA -> = "
$IPT -t filter=20 -A TCP_RULES -o $FW_INET_IFACE -p tcp --source-port 20 = --destination-port=20 $UNPRIVPORTS -m state --state NEW -j ACCEPT
 
# DATA PORT=20 (Passive Mode)
$IPT -t filter -A TCP_RULES -i $FW_INET_IFACE -p tcp = --source-port $UNPRIVPORTS --destination-port $UNPRIVPORTS -m state = --state=20 NEW -j LOG --log-level $LOG_LEVEL --log-prefix "FTP P-DATA ->=20 "
$IPT -t filter=20 -A TCP_RULES -i $FW_INET_IFACE -p tcp --source-port $UNPRIVPORTS=20 --destination-port $UNPRIVPORTS -m state --state NEW -j=20 ACCEPT

From: = netfilter-admin@lists.netfilter.org=20 [mailto:netfilter-admin@lists.netfilter.org] On Behalf Of = Christian=20 Gmeiner
Sent: Tuesday, January 20, 2004 8:01 = AM
To:=20 netfilter@lists.netfilter.org
Subject: Problem with=20 connection-tracking and FTP

Hi everybody.
 
I am working on a little firewall = script.=20 Everything works just fine, but i dont get the ftp protocoll=20 working.
 
I call this two function to get ftp=20 working:
 
#=20 = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D
FTP()
{
    ebegin=20 "Seting rules for active/passive FTP"
 
    # Port = 21
 
    iptables -A=20 INPUT     -p tcp --sport 21 -m state --state = ESTABLISHED=20 -j ACCEPT
    iptables -A OUTPUT -p tcp --dport 21 = -m state=20 --state NEW,ESTABLISHED -j ACCEPT
 
    # = aktiv
   =20 iptables -A INPUT     -p tcp --sport 20 -m state = --state=20 ESTABLISHED,RELATED -j ACCEPT
    iptables -A = OUTPUT -p tcp=20 --dport 20 -m state --state ESTABLISHED -j ACCEPT
 
    # = passiv
   =20 iptables -A INPUT     -p tcp --sport 1024: --dport = 1024:  -m state --state ESTABLISHED -j ACCEPT =
   =20 iptables -A OUTPUT -p tcp --sport 1024: --dport 1024:  -m state = --state=20 ESTABLISHED,RELATED -j ACCEPT
 
    eend = $?
}
 

#=20 = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D
loadmodules()
{
   =20 ebegin "Try to load needed modules"
 
    /sbin/modprobe ip_tables
    = /sbin/modprobe iptable_filter
    /sbin/modprobe=20 ip_conntrack
    /sbin/modprobe=20 ip_conntrack_ftp
    /sbin/modprobe=20 ipt_ULOG
    eend $?
}
 
An here my start function
# = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D
start()=20
{
    ebegin "Starting Firewall"
 
    loadmodules
 
    einfo "Setting default rules to=20 drop"
    iptables -F
    iptables = -X=20
    iptables -Z
    iptables -F=20 INPUT
    iptables -F OUTPUT
    = iptables=20 -F FORWARD
 
    iptables -P FORWARD DROP
    = iptables -P INPUT   DROP
    iptables -P=20 OUTPUT  DROP
 
    acceptlocal
   =20 portscan
    proc
   =20 iana
    illigalpackages
   =20 spoofing
    FTP
 
    # set rules
   =20 InOutTCP
    InTCP
   =20 OutTCP
    InOutUDP
   =20 InUDP
    OutUDP
 
    # Erlaube dem Client routen durch NAT (Network = Address=20 Translation
    iptables -t nat -A POSTROUTING -o = ${EXT_INT}=20 -j MASQUERADE
    echo "1" >=20 /proc/sys/net/ipv4/ip_forward
 
    eend $? "Failed to start Firewall"
}
 
 
And here are the ports i allow with the function InOut*, In*,=20 Out*,...
 
# TCP in+out
#
TCP_IN_OUT=3D"ssh 10000 smtp pop3 http = https"
 
# TCP out
#
# 5190 =3D ICQ
#
TCP_OUT=3D"5190 http = https irc 25=20 ftp ftp-data"
 
# TCP in
#
TCP_IN=3D""
 
# UDP in+out
#
UDP_IN_OUT=3D"domain ssh 10000 pop3 = ssh"
 
# UDP out
#
UDP_OUT=3D"https irc"
 
# UDP in
#
UDP_IN=3D""
 
 
Oh and here some important functions:
 
#=20 = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D
InOutTCP()
{
   =20 ebegin "Allowing in and outbound TCP-traffic"
 
    for i in ${TCP_IN_OUT}
   =20 do
        einfo "   = <->=20 Seting TCP "in" and "out" rules for ${i}"
 
        iptables -A = INPUT  -j=20 ACCEPT -i ${EXT_INT} -p tcp --dport ${i} -m state --state=20 NEW,ESTABLISHED,RELATED
        = iptables=20 -A OUTPUT -j ACCEPT -o ${EXT_INT} -p tcp --sport ${i} --dport 1024: -m = state=20 --state = ESTABLISHED,RELATED
       =20 iptables -A FORWARD  -j ACCEPT -i ${EXT_INT} -p tcp --dport ${i} = -m state=20 --state = NEW,ESTABLISHED,RELATED
       =20 iptables -A FORWARD -j ACCEPT -o ${EXT_INT} -p tcp --sport ${i} -m = state=20 --state ESTABLISHED,RELATED
 
        iptables -A OUTPUT -j = ACCEPT=20 -o ${EXT_INT} -p tcp --sport 1024: --dport ${i} -m state --state=20 NEW,ESTABLISHED,RELATED
        = iptables=20 -A INPUT  -j ACCEPT -i ${EXT_INT} -p tcp --sport ${i} -m state = --state=20 ESTABLISHED,RELATED
        = iptables -A=20 FORWARD -j ACCEPT -o ${EXT_INT} -p tcp -s ${LAN} --sport 1024: --dport = ${i} -m=20 state --state=20 NEW,ESTABLISHED,RELATED
        = iptables=20 -A FORWARD  -j ACCEPT -i ${EXT_INT} -p tcp --sport ${i} -d ${LAN} = -m=20 state --state ESTABLISHED,RELATED
    done
 
    eend $?
}
 
# = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=20
OutTCP()
{
    ebegin "Allowing outbound=20 TCP-traffic"
 
    for i in ${TCP_OUT}
   =20 do
        einfo "   = <->=20 Seting TCP "out" rules for ${i}"
 
        iptables -A OUTPUT -j = ACCEPT=20 -o ${EXT_INT} -p tcp --sport 1024: --dport $i -m state --state=20 NEW,ESTABLISHED,RELATED
        = iptables=20 -A INPUT  -j ACCEPT -i ${EXT_INT} -p tcp --sport $i -m state = --state=20 ESTABLISHED,RELATED
        = iptables -A=20 FORWARD -j ACCEPT -o ${EXT_INT} -p tcp -s ${LAN} --sport 1024: --dport = $i -m=20 state --state=20 NEW,ESTABLISHED,RELATED
        = iptables=20 -A FORWARD  -j ACCEPT -i ${EXT_INT} -p tcp --sport $i -d ${LAN} = -m state=20 --state ESTABLISHED,RELATED
    done
 
    eend $?
}
 
I hope somebody can help me.
 
Thanks, Christian Gmeiner
 
=
 
------=_NextPart_000_0000_01C3E04A.32A5BC30--