Re: passive mode ftp high ports driving me nuts

[MargoAndTodd <margoandtodd@gmail.com>]

On 01/08/2010 02:24 AM, Mart Frauenlob wrote:

>> It is the "--sport $unassgn --dport $unassgn" that is killing me.
>> How do I restrict the last three to just passive mode ftp?
>>
>
> use the 'helper' match extension. i.e: -m helper --helper ftp.
> if you need to distinguish between active and passive, you still can use
> the port and state matches for that.

Hi Mart,

Works perfectly.  Thank you!

-T

p.s. my new rules:

# ftp passive mode (browser) stuff.  Note: ftp_conntrack module is 
required, e.g.:
# /etc/sysconfig/iptables-config:
# IPTABLES_MODULES="ip_conntrack_ftp"
#
$tbls -A dsl-out  -o eth1  -p tcp  -s $eth1_addr --sport $unassgn 
--dport ftp         -m state --state NEW,ESTABLISHED           -j ACCEPT
$tbls -A dsl-in   -i eth1  -p tcp  ! --syn --sport ftp -d $eth1_addr 
--dport $unassgn -m state --state RELATED,ESTABLISHED       -j ACCEPT
$tbls -A dsl-for  -i eth1  -p tcp  ! --syn --sport ftp -d $internal_net 
  --dport $unassgn  -m state --state RELATED,ESTABLISHED  -j ACCEPT
# The "ftpdata" session is a "new" one when it sends the SYN.  However, 
the ftp_conntrack module marks it as related to its controlling
# ftp session, so that state=related matches.  This should deny any 
"ftpdata" session that doesn't have a controlling ftp session.
#$tbls -A dsl-out  -o eth1  -p tcp  -s $eth1_addr --sport $unassgn -d 
$ANY_IP --dport $unassgn -m state --state RELATED,ESTABLISHED 
      -j ACCEPT
#$tbls -A dsl-in   -i eth1  -p tcp  ! --syn  -s $ANY_IP --sport $unassgn 
-d $eth1_addr --dport $unassgn  -m state --state RELATED,ESTABLISHED 
   -j ACCEPT
#$tbls -A dsl-for  -i eth1  -p tcp  ! --syn  -s $ANY_IP --sport $unassgn 
-d $internal_net --dport $unassgn   -m state --state RELATED,ESTABLISHED 
  -j ACCEPT
$tbls -A dsl-out  -o eth1  -p tcp  -s $eth1_addr       -d $ANY_IP 
-m helper --helper ftp -m state --state RELATED,ESTABLISHED  -j ACCEPT
$tbls -A dsl-in   -i eth1  -p tcp  ! --syn  -s $ANY_IP -d $eth1_addr 
-m helper --helper ftp -m state --state RELATED,ESTABLISHED  -j ACCEPT
$tbls -A dsl-for  -i eth1  -p tcp  ! --syn  -s $ANY_IP -d $internal_net 
-m helper --helper ftp -m state --state RELATED,ESTABLISHED  -j ACCEPT