Re: Can I use ip_conntrack_ftp on a server firewall ?

[Robert Nichols <rnicholsNOSPAM@comcast.net>]

Aaron Gray wrote:
>>> How do I create rules to allow FTP passive and active connections to 
>>> the server ?
>>>
>>> Do I use ip_conntrack_ftp or can I just create some rules that will 
>>> do the job ?
>>
>>
>> You need ip_conntrack_ftp.  To get that modules loaded automatically,
>> Just edit /etc/sysconfig/iptables and add "ip_conntrack_ftp" to the
>> "IPTABLES_MODULES=" line.
> 
> 
> Okay I have ip_conntrack_ftp loaded in /etc/sysconfig/iptables-config.
> 
> Still it must require some rules to use it.

Well, you obviously need to allow the initial incoming connection to
port 21.  Beyond that, all you should need are the usual rules to
allow all ESTABLISHED and RELATED traffic.  With the conntrack
module working, the ftp-data connection will be recognized as
RELATED.  Unless there NAT involved (requiring use of the ip_nat_ftp
module), it should "just work".

-- 
Bob Nichols         Yes, "NOSPAM" is really part of my email address.