From mboxrd@z Thu Jan 1 00:00:00 1970 From: Robert Nichols Subject: Re: Can I use ip_conntrack_ftp on a server firewall ? Date: Sun, 18 Dec 2005 01:59:26 -0600 Message-ID: References: <004301c6029a$b49f8490$0200a8c0@AMDADVENT> <005901c6037d$c3709b10$0400a8c0@AMDADVENT> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <005901c6037d$c3709b10$0400a8c0@AMDADVENT> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="us-ascii"; format="flowed" To: netfilter@lists.netfilter.org Aaron Gray wrote: >>> How do I create rules to allow FTP passive and active connections to >>> the server ? >>> >>> Do I use ip_conntrack_ftp or can I just create some rules that will >>> do the job ? >> >> >> You need ip_conntrack_ftp. To get that modules loaded automatically, >> Just edit /etc/sysconfig/iptables and add "ip_conntrack_ftp" to the >> "IPTABLES_MODULES=" line. > > > Okay I have ip_conntrack_ftp loaded in /etc/sysconfig/iptables-config. > > Still it must require some rules to use it. Well, you obviously need to allow the initial incoming connection to port 21. Beyond that, all you should need are the usual rules to allow all ESTABLISHED and RELATED traffic. With the conntrack module working, the ftp-data connection will be recognized as RELATED. Unless there NAT involved (requiring use of the ip_nat_ftp module), it should "just work". -- Bob Nichols Yes, "NOSPAM" is really part of my email address.