From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Taylor, Grant" Subject: Re: ftps and iptables Date: Thu, 18 Aug 2005 14:52:31 -0500 Message-ID: <4304E6FF.8070206@riverviewtech.net> References: Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.netfilter.org Try looking in to a reverse proxy (Squid) that support SSL. This way your clients would FTPS to the proxy box which would in turn connect to the FTPS server behind the firewall. Grant. . . . Derick Anderson wrote: > By default FTPS (FTP over SSL, not to be confused with FTP/SSH or SFTP) > runs on port 990. It also sounds like you're using passive mode - if so > you may need to open those ports as well. It would make sense to me > (although I don't know) that conntrack_ftp could only track unsecured > FTP sessions since the only indication of a port change is in the packet > data (which would be encrypted). Someone may know better than I, though.