All of lore.kernel.org
 help / color / mirror / Atom feed
* FTP Problem
@ 2007-02-26 19:46 Vincent Elderkamp
  2007-02-27  8:23 ` Rob Sterenborg
  0 siblings, 1 reply; 7+ messages in thread
From: Vincent Elderkamp @ 2007-02-26 19:46 UTC (permalink / raw)
  To: netfilter

Hi,

I'm a new user for netfilter en doesn't have experience with it...

I have written a simple firewall script in the past it works perfect,
but know the FTP section doesn't work at all....

Maybe can somebody help me.

Here is my code :

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp -i eth0 -s any/0 -d any/0 --dport 21 -j ACCEPT
iptables -A OUTPUT -p tcp -o eth0 -s any/0 --sport 21 -d any/0 ! --syn
-j ACCEPT
iptables -A INPUT -p tcp -i eth0 -s any/0 -d any/0 --dport 20 -j ACCEPT
iptables -A OUTPUT -p tcp -o eth0 -s any/0 --sport 20 -d any/0 ! --syn
-j ACCEPT


I have found some code on the internet but that doesn't work at all :

## FTP
# Allow ftp outbound.
iptables -A INPUT  -i eth0 -p tcp --sport 21 -m state --state
ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 21 -m state --state
NEW,ESTABLISHED -j ACCEPT
# Now for the connection tracking part of ftp. This is discussed more
completely in my section
# on connection tracking to be found here.
# 1) Active ftp.
# This involves a connection INbound from port 20 on the remote machine,
to a local port
# passed over the ftp channel via a PORT command. The ip_conntrack_ftp
module recognizes
# the connection as RELATED to the original outgoing connection to port
21 so we don't
# need NEW as a state match.
iptables -A INPUT  -i eth0 -p tcp --sport 20 -m state --state
ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 20 -m state --state
ESTABLISHED -j ACCEPT
# 2) Passive ftp.
# This involves a connection outbound from a port >1023 on the local
machine, to a port >1023
# on the remote machine previously passed over the ftp channel via a
PORT command. The
# ip_conntrack_ftp module recognizes the connection as RELATED to the
original outgoing
# connection to port 21 so we don't need NEW as a state match.
iptables -A INPUT  -i eth0 -p tcp --sport 1024:65535 --dport 1024:65535 \
  -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 1024:65535 --dport 1024:65535 \
  -m state --state ESTABLISHED,RELATED -j ACCEPT


Hope someone can help me,

Thank you very much

Vincent


^ permalink raw reply	[flat|nested] 7+ messages in thread
* FTP problem....
@ 2003-04-02 14:35 Tom Troonbeeckx
  2003-04-02 14:44 ` Jamie Harris
  0 siblings, 1 reply; 7+ messages in thread
From: Tom Troonbeeckx @ 2003-04-02 14:35 UTC (permalink / raw)
  To: linux-admin

Hi friends,

recently I installed the ftp-server proftpd-1.2.8.  Before I started the
daemon I stopped the previous FTP-server wu-ftpd.

Currently I have no FTP-daemon started, however.  When i telnet to mine
server(Redhat 7.1) I still got a fingerprint from the wu-ftpd.

Initial I thought there must be running still a wu-daemon.
I listed all processes and grepped for an ftp string (ps -waux | grep ftp).
Still nothing to see.
After that I utilised lsof(lsof-4.67) and grabbed for any ftp matches.
Still empty results.

In a nutshell, in the procestable is no entry which indicates there is an
ftp-daemon is running, on the otherhand telnetting shows me a differten
result.

Any ideas how this is possible or how I can stop the 'hidden' daemon for
listening on port 21.

Thanks in advance...

 Ideaxis nv
-facing the internet-

Flanders Multimedia Valley
Wetenschapspark 1
B-3590 DIEPENBEEK

Tel : +32 11 26 89 20
Fax : +32 11 23 22 17
Mobile: +32 479 13 14 81

E-Mail: tom.troonbeeckx@ideaxis.com
URL: http://www.ideaxis.com/

Ideaxis nv legal disclaimer
The information contained in this e-mail is confidential and may be
privileged. It may be read, copied and used only by the intended recipient.
If you have received it in error, please contact the sender immediately by
returning this e-mail. Please delete this e-mail and do not disclose its
contents to any person. Ideaxis nv does not accept liability for any
errors, omissions, delays of receipt or viruses in the contents of this
message which arise as a result of e-mail transmission.



^ permalink raw reply	[flat|nested] 7+ messages in thread
end of thread, other threads:[~2007-02-27 15:58 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2007-02-26 19:46 FTP Problem Vincent Elderkamp
2007-02-27  8:23 ` Rob Sterenborg
2007-02-27 15:58   ` Vincent Elderkamp
  -- strict thread matches above, loose matches on Subject: below --
2003-04-02 14:35 FTP problem Tom Troonbeeckx
2003-04-02 14:44 ` Jamie Harris
2003-04-02 14:52   ` Tom Troonbeeckx
2003-04-02 15:06   ` César Soler

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.