RE: ip_conntrack_ftp doesn't work with ftp proxy

RE: ip_conntrack_ftp doesn't work with ftp proxy

[Kim Leandersson]

Try loading the ip_conntrack_ftp module with the option ports instead.

ip_conntrack_ftp ports=8082 should do the trick for you!

//kim

> -----Original Message-----
> From: Thomas Boernert [mailto:tb@tbits.net] 
> Sent: Wednesday, November 13, 2002 10:55 PM
> To: netfilter@lists.netfilter.org
> Subject: ip_conntrack_ftp doesn't work with ftp proxy
> 
> 
> Hello,
> 
> i hope anyone can help me.
> 
> network-chart
> 
> linuxbox ----- firewall ---- internet
> 
> on the firewall runs a ftp proxy (suse proxy-suite on port 
> 8082) i've the following rules
> 
> iptables -A INPUT -p tcp -s $local_net --sport 1024:65535 -d 
> $firewall_internal_ip --dport 8082 -m state --state 
> NEW,ESTABLISHED -j ACCEPT
> 
> ipatbles -A OUTPUT -p tcp -s $firewall_internal_ip --sport 
> 8082 -d $local_net --dport 1024:65535 -m state --state 
> ESTABLISHED -j ACCEPT
> 
> iptables -A INPUT -p tcp -s $local_net --sport 1024:65535 -d 
> $firewall_internal_ip --dport 1024:65535 -m state ESTABLISHED,RELATED
> 
> .....
> 
> from the client i do the following
> 
> ftp ip_firewall 8082
> login to a ftp server like redhat or so
> do "ls"
> then the kernel rejects the third rule written upper.
> 
> if i change the rule from RELATED to NEW, the it's working, 
> but this is not a solution.
> 
> Thanks for help!
> 
> - Thomas
> 
> 
> 
> 

Related but general question. (WAS:Re: ip_conntrack_ftp doesn't work with ftp proxy)

[Alasdair Ramsay]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

If you can pass additional information to the modules as you load them,
can you pass the same information to a module that is statically built
into the kernel?  How is such information passed?

Regards

Alasdair Ramsay

Kim Leandersson wrote:
| Try loading the ip_conntrack_ftp module with the option ports instead.
|
| ip_conntrack_ftp ports=8082 should do the trick for you!
|
| //kim
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.0 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQE92kfO4+7BX0uR648RAqWWAJ9DFe+ts78YiTIZQiHaAu7ANlNdSQCfR5Mx
cWTAQ8VRAoz2gkZ4mq3WbLA=
=RGSK
-----END PGP SIGNATURE-----