passive ftp

passive ftp

[IT Clown]

Hi 

I am having some trouble to access passive mode ftp sites.I
have a firewall with ip forwarding enabled.When a pc on the
network want to access passive ftp servers i need to do the
following in my rules ( on the server ):

-A OUTPUT -p tcp -m multiport --dport 21,20 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eth0 -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

But i do not want every query to be forwarded i only want
say ftp access to be forwarded. Why does the following not
work ( on the server ):

-A FORWARD -p tcp -i eth0 -o ppp0 --dport 20 -j ACCEPT
-A FORWARD -p tcp -i eth0 -o ppp0 --dport 21 -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
Regards
______________________________________________________________
Herbalife Independent Distributor http://www.healthiest.co.za

Is there a more active mailing list for security?

[Krunk]

This list seems a little slow...maybe one or two questions a day.
Haven't seen a reply yet. Would anyone know what a more active mailing
list would be where I could receive help?

James

RE: Is there a more active mailing list for security?

[Mark E. Donaldson]

 

-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Krunk
Sent: Saturday, April 17, 2004 11:04 AM
To: netfilter@lists.netfilter.org
Subject: Is there a more active mailing list for security?

This list seems a little slow...maybe one or two questions a day.
Haven't seen a reply yet. Would anyone know what a more active mailing list
would be where I could receive help?

James

Just have patience my friend. You won't find any help better or quicker for
iptables/netfilter anywhere else. Why not try posting your question again.
Anthony Stone must have gone somewhere for the weekend but perhaps someone
else can help you.

Re: passive ftp

[Krunk]

This did it for me:
IPT=/usr/sbin/iptables
EXTIF=ppp0 # interface facing outward
EXTIP=xxx.xxx.xxx.xxx
INTIF=eth1
INTNET=<ip assigned to eth1>
TCP="ftp ftp-data"
for i in $TCP
do
$IPT -A OUTPUT -o $EXTIF -p tcp -s $EXTIP --dport $i --syn -m state --state NEW -j ACCEPT
$IPT -A FORWARD -i $INTIF -p tcp -s $INTNET --dport $i --syn -m state --state NEW -j ACCEPT
done

You can put any number of services defined in /etc/services in the TCP
list and free them up with the loop. 

On Sat, 2004-04-17 at 12:50, IT Clown wrote:
> Hi 
> 
> I am having some trouble to access passive mode ftp sites.I
> have a firewall with ip forwarding enabled.When a pc on the
> network want to access passive ftp servers i need to do the
> following in my rules ( on the server ):
> 
> -A OUTPUT -p tcp -m multiport --dport 21,20 -j ACCEPT
> -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
> -A FORWARD -i eth0 -j ACCEPT
> -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
> 
> But i do not want every query to be forwarded i only want
> say ftp access to be forwarded. Why does the following not
> work ( on the server ):
> 
> -A FORWARD -p tcp -i eth0 -o ppp0 --dport 20 -j ACCEPT
> -A FORWARD -p tcp -i eth0 -o ppp0 --dport 21 -j ACCEPT
> -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
> Regards
> ______________________________________________________________
> Herbalife Independent Distributor http://www.healthiest.co.za

Re: passive ftp

[IT Clown]

Sorry i left out something about the following rule:
> -A FORWARD -p tcp -i eth0 -o ppp0 --dport 20 -j ACCEPT
> -A FORWARD -p tcp -i eth0 -o ppp0 --dport 21 -j ACCEPT
> -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

When i set the rule i can connect to passive mode ftp
servers but when it needs to list the contents of the ftp
server it will list nothing or i will get disc from the ftp
server.



On Sat, 17 Apr 2004 19:50:35 +0200
 "IT Clown" <iptables@mailbox.co.za> wrote:
> Hi 
> 
> I am having some trouble to access passive mode ftp
> sites.I
> have a firewall with ip forwarding enabled.When a pc on
> the
> network want to access passive ftp servers i need to do
> the
> following in my rules ( on the server ):
> 
> -A OUTPUT -p tcp -m multiport --dport 21,20 -j ACCEPT
> -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
> -A FORWARD -i eth0 -j ACCEPT
> -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
> 
> But i do not want every query to be forwarded i only want
> say ftp access to be forwarded. Why does the following
> not
> work ( on the server ):
> 
> -A FORWARD -p tcp -i eth0 -o ppp0 --dport 20 -j ACCEPT
> -A FORWARD -p tcp -i eth0 -o ppp0 --dport 21 -j ACCEPT
> -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
> Regards
>
______________________________________________________________
> Herbalife Independent Distributor
> http://www.healthiest.co.za
> 

______________________________________________________________
Herbalife Independent Distributor http://www.healthiest.co.za

RE: passive ftp

[Mark E. Donaldson]

 

-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org] On Behalf Of IT Clown
Sent: Saturday, April 17, 2004 10:51 AM
To: netfilter@lists.netfilter.org
Subject: passive ftp

Hi 

I am having some trouble to access passive mode ftp sites.I have a firewall
with ip forwarding enabled.When a pc on the network want to access passive
ftp servers i need to do the following in my rules ( on the server ):

-A OUTPUT -p tcp -m multiport --dport 21,20 -j ACCEPT -A INPUT -m state
--state RELATED,ESTABLISHED -j ACCEPT -A FORWARD -i eth0 -j ACCEPT -A
FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

But i do not want every query to be forwarded i only want say ftp access to
be forwarded. Why does the following not work ( on the server ):

-A FORWARD -p tcp -i eth0 -o ppp0 --dport 20 -j ACCEPT -A FORWARD -p tcp -i
eth0 -o ppp0 --dport 21 -j ACCEPT -A FORWARD -m state --state
RELATED,ESTABLISHED -j ACCEPT Regards 
______________________________________________________________
Herbalife Independent Distributor http://www.healthiest.co.za


Be sure you have the two support modules you need loaded:

$MODPROBE ip_nat_ftp
$MODPROBE ip_conntrack_ftp

Passive FTP data transfers take place on a "high port" that the server
recommends to the client, and the client then establishes the new connection
on that high port that the server uses as well. Neither Port 20 or 21 are
used during this part of the process.  Therefore, the ftp connection
tracking modules are necessary for all this to happen.

NAT FTP module problem

[GoMi]

I have a problem inserting the ipt_nat_module

insmod ip_nat_ftp
Using /lib/modules/2.4.20/kernel/net/ipv4/netfilter/ip_nat_ftp.o
/lib/modules/2.4.20/kernel/net/ipv4/netfilter/ip_nat_ftp.o: init_module:
Device or resource busy
Hint: insmod errors can be caused by incorrect module parameters, including
invalid IO or IRQ parameters.
      You may find more information in syslog or the output from dmesg

Any ideas?

-----Mensaje original-----
De: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org] En nombre de Mark E. Donaldson
Enviado el: sábado, 17 de abril de 2004 21:06
Para: 'IT Clown'; netfilter@lists.netfilter.org
Asunto: RE: passive ftp

 

-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org] On Behalf Of IT Clown
Sent: Saturday, April 17, 2004 10:51 AM
To: netfilter@lists.netfilter.org
Subject: passive ftp

Hi 

I am having some trouble to access passive mode ftp sites.I have a firewall
with ip forwarding enabled.When a pc on the network want to access passive
ftp servers i need to do the following in my rules ( on the server ):

-A OUTPUT -p tcp -m multiport --dport 21,20 -j ACCEPT -A INPUT -m state
--state RELATED,ESTABLISHED -j ACCEPT -A FORWARD -i eth0 -j ACCEPT -A
FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

But i do not want every query to be forwarded i only want say ftp access to
be forwarded. Why does the following not work ( on the server ):

-A FORWARD -p tcp -i eth0 -o ppp0 --dport 20 -j ACCEPT -A FORWARD -p tcp -i
eth0 -o ppp0 --dport 21 -j ACCEPT -A FORWARD -m state --state
RELATED,ESTABLISHED -j ACCEPT Regards 
______________________________________________________________
Herbalife Independent Distributor http://www.healthiest.co.za


Be sure you have the two support modules you need loaded:

$MODPROBE ip_nat_ftp
$MODPROBE ip_conntrack_ftp

Passive FTP data transfers take place on a "high port" that the server
recommends to the client, and the client then establishes the new connection
on that high port that the server uses as well. Neither Port 20 or 21 are
used during this part of the process.  Therefore, the ftp connection
tracking modules are necessary for all this to happen.

passive ftp

[Luis Miguel Cruz Miranda]

Ok, I spend more than 30 minutes and I couldn't discover how to allow 
inbound passive ftp.
Can anyone write me a generic iptables rules?

Thanks

Luis Miguel Cruz Miranda.               |       B2B INTEGRAL, S.A.
CCNA - Systems Administrator            |       Pol. Ind. de Asipo
                                         |       C/A - Parcela 86-C
Tel: +34 902 506 605                    |       33.428 - CAYES - LLANERA
Fax:+34 985 980 794                     |       ASTURIAS (ESPAÑA/SPAIN)

Re: passive ftp

[Cedric Blancher]

Le mar 11/02/2003 à 17:43, Luis Miguel Cruz Miranda a écrit :
> Ok, I spend more than 30 minutes and I couldn't discover how to allow 
> inbound passive ftp.

Just load ip_conntrack_ftp then allow RELATED state and you're done.

> Can anyone write me a generic iptables rules?

iptables -A INPUT -m state --state RELATED -j ACCEPT

Can't be more generic.

-- 
Cédric Blancher  <blancher@cartel-securite.fr>
IT systems and networks security expert  - Cartel Sécurité
Phone : +33 (0)1 44 06 97 87 - Fax: +33 (0)1 44 06 97 99
PGP KeyID:157E98EE  FingerPrint:FA62226DA9E72FA8AECAA240008B480E157E98EE