Re: Allowing FTP and internal but nothing else

[David Cannings <lists@edeca.net>]

On Wednesday 03 March 2004 16:55, Paul Harlow wrote:
> I have an FTP server that I would like to filter out all external
> traffic except ftp and ftp-data. This same server has an internal
> interface that I would like to allow everything on the inside to have
> access to. Given what I've read I have come up with this general idea
> of what to put into a filter table for now. Please let me know what
> your gurus of netfilter think. Thanks!

I am no guru but here is my 2c.

> iptables -I INPUT -i eth0 -j ACCEPT

This would accept any packet coming in on eth0, this is fine as long as 
you didn't want to be more restrictive about this interface.

> iptables -I INPUT -i eth1 -d port 21 -j ACCEPT
> iptables -I INPUT -i eth1 -d port 20 -j ACCEPT

Both should be "--dport", "-d" is destination, for hosts.  You'd use -d 
like this:

iptables -I INPUT -d 192.168.0.1 -j ACCEPT

Your rule above could be rewritten as:

iptables -I INPUT -i eth1 --dport 21 -j ACCEPT

> iptables -I INPUT -i eth1 -j deny

Note that "deny" isn't a valid target, unless you've definied your own 
chain called "deny".  From the manual page, the correct target would be 
"DROP".

> I am assuming this is similar to Cisco access lists in that it will
> read along the filter list until a hit is made then take action. Please
> correct me if I am wrong.

iptables is "first match", yes.  The first rule that matches a packet will 
be the one that controls the fate of it.  This can, however, include 
jumping through other chains.

For FTP, you might like to look into the FTP connection tracking helpers.  
Also, you may well need rules to allow established or related packets.

Hope this helps,

David