From mboxrd@z Thu Jan 1 00:00:00 1970 From: Andy Furniss Date: Mon, 10 May 2004 20:37:27 +0000 Subject: Re: [LARTC] ip_conntrack_ftp Message-Id: <409FE807.1060308@dsl.pipex.com> List-Id: References: <20040511012222.6c12892f@vr> In-Reply-To: <20040511012222.6c12892f@vr> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: lartc@vger.kernel.org raptor wrote: > As read here : > http://www.sns.ias.edu/~jns/security/iptables/iptables_conntrack.html > > modprobe ip_conntrack_ftp > would give me the ability to use active ftp if I have (pseudo/simplified code) > > iptables -A FORWARD -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT > iptables -A FORWARD -j DROP > > but I cant use active ftp, WHAT IS WRONG.. eth0 is the internal interface.. > If you are NATing use ip_nat_ftp aswell. Not sure that that firewall rule is OK - but then I don't know what else you have. My firewall is a direct copy and paste from one of rustys guides - ppp0 is my external interface - ## Create chain which blocks new connections, except if coming from inside. iptables -N block iptables -A block -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A block -m state --state NEW -i ! ppp0 -j ACCEPT iptables -A block -j DROP ## Jump to that chain from INPUT and FORWARD chains. iptables -A INPUT -j block iptables -A FORWARD -j block Andy. _______________________________________________ LARTC mailing list / LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/