From: Mart Frauenlob <mart.frauenlob@chello.at>
To: netfilter@vger.kernel.org
Cc: Jeff Jensen <jjensen@unyalli.com>
Subject: Re: Help with ftp helper please
Date: Sun, 25 Apr 2010 12:04:41 +0200 [thread overview]
Message-ID: <4BD413B9.90900@chello.at> (raw)
In-Reply-To: <alpine.LSU.2.01.1004251108170.5896@obet.zrqbmnf.qr>
On 25.04.2010 11:09, Jan Engelhardt wrote:
> On Sunday 2010-04-25 08:49, Mart Frauenlob wrote:
>
>> On 24.04.2010 18:48, Jeff Jensen wrote:
>>> I have an email conversation from Jan 9, 2010 between
>>> mart.frauenlob@chello.at and margoandtodd@gmail.com with the subject
>>> "passive mode ftp high ports driving me nuts". I have studied this
>>> intensely and found out about this "helper" thing.
>> you don't allow sport 21 back incoming traffic.
>> btw: nf_nat_ftp is also loaded?
>
> That's why one should always have -m conntrack --ctstate ESTABLISHED(,RELATED)
> in INPUT, FORWARD, and OUTPUT. It really trims down all these rules.
>
Yes, if the OP would have looked up the original post correctly it would
show exactly that.
http://eeek.borgchat.net/lists/netfilter/msg47205.html
Putting the global RELATED rule, of course makes most of the rules
obsolete (which fits in most cases), but that example was to show how to
use the (ftp) helper match, if one chooses to split things up for
whatever reason.
Good day
Mart
next prev parent reply other threads:[~2010-04-25 10:04 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-04-24 16:48 Help with ftp helper please Jeff Jensen
2010-04-25 6:49 ` Mart Frauenlob
2010-04-25 9:09 ` Jan Engelhardt
2010-04-25 10:04 ` Mart Frauenlob [this message]
2010-05-18 13:27 ` Markus Feldmann
2010-04-25 12:00 ` Jeff Jensen
2010-04-25 12:31 ` Jan Engelhardt
2010-04-25 11:50 ` Jeff Jensen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4BD413B9.90900@chello.at \
--to=mart.frauenlob@chello.at \
--cc=jjensen@unyalli.com \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.