Can I use ip_conntrack_ftp on a server firewall ?

Can I use ip_conntrack_ftp on a server firewall ?

[Aaron Gray]

I have a RedHat 9 and Fedora Core 4 Servers I am setting up. I am using an 
FTP demon on the server, Apache mod_ftpd, but when enabled the firewall is 
blocking the FTP connection.

How do I create rules to allow FTP passive and active connections to the 
server ?

Do I use ip_conntrack_ftp or can I just create some rules that will do the 
job ?

Many thanks in advance,

Aaron 

Re: Can I use ip_conntrack_ftp on a server firewall ?

[Robert Nichols]

Aaron Gray wrote:
> I have a RedHat 9 and Fedora Core 4 Servers I am setting up. I am using 
> an FTP demon on the server, Apache mod_ftpd, but when enabled the 
> firewall is blocking the FTP connection.
> 
> How do I create rules to allow FTP passive and active connections to the 
> server ?
> 
> Do I use ip_conntrack_ftp or can I just create some rules that will do 
> the job ?

You need ip_conntrack_ftp.  To get that modules loaded automatically,
Just edit /etc/sysconfig/iptables and add "ip_conntrack_ftp" to the
"IPTABLES_MODULES=" line.

-- 
Bob Nichols         Yes, "NOSPAM" is really part of my email address.

Re: Can I use ip_conntrack_ftp on a server firewall ?

[Aaron Gray]

>> How do I create rules to allow FTP passive and active connections to the 
>> server ?
>> 
>> Do I use ip_conntrack_ftp or can I just create some rules that will do 
>> the job ?
> 
> You need ip_conntrack_ftp.  To get that modules loaded automatically,
> Just edit /etc/sysconfig/iptables and add "ip_conntrack_ftp" to the
> "IPTABLES_MODULES=" line.

Okay I have ip_conntrack_ftp loaded in /etc/sysconfig/iptables-config.

Still it must require some rules to use it.

Aaron

Re: Can I use ip_conntrack_ftp on a server firewall ?

[Robert Nichols]

Aaron Gray wrote:
>>> How do I create rules to allow FTP passive and active connections to 
>>> the server ?
>>>
>>> Do I use ip_conntrack_ftp or can I just create some rules that will 
>>> do the job ?
>>
>>
>> You need ip_conntrack_ftp.  To get that modules loaded automatically,
>> Just edit /etc/sysconfig/iptables and add "ip_conntrack_ftp" to the
>> "IPTABLES_MODULES=" line.
> 
> 
> Okay I have ip_conntrack_ftp loaded in /etc/sysconfig/iptables-config.
> 
> Still it must require some rules to use it.

Well, you obviously need to allow the initial incoming connection to
port 21.  Beyond that, all you should need are the usual rules to
allow all ESTABLISHED and RELATED traffic.  With the conntrack
module working, the ftp-data connection will be recognized as
RELATED.  Unless there NAT involved (requiring use of the ip_nat_ftp
module), it should "just work".

-- 
Bob Nichols         Yes, "NOSPAM" is really part of my email address.

Re: Can I use ip_conntrack_ftp on a server firewall ?

[Aaron Gray]

>> Okay I have ip_conntrack_ftp loaded in /etc/sysconfig/iptables-config.
>>
>> Still it must require some rules to use it.
>
> Well, you obviously need to allow the initial incoming connection to
> port 21.  Beyond that, all you should need are the usual rules to
> allow all ESTABLISHED and RELATED traffic.  With the conntrack
> module working, the ftp-data connection will be recognized as
> RELATED.  Unless there NAT involved (requiring use of the ip_nat_ftp
> module), it should "just work".

I added a NEW and it now "just works" with Windows Internet Explorer as well 
as Unix FTP.

Aaron