Re: AW: IP_TABLES Q

["Andrew B. Cramer" <andrew.cramer@cramer-ts.com>]

Hi Arend,
	Thanks for responding. I was right in the change from 21 to 23, but 
that had no effect for FTP. In the past, I used Linux-2.2.x with 
IP_CHAINS. With that I had used the ip_masq_ftp module. That worked. 
I guess what I'm looking for is what use for FTP rules and where to 
put them. The symptom is the client, Win2K with WS_FTP. The WS_FTP 
responds, "425 Can't build data connection: No route to host." line 
2, "! Retrieve of folder listing failed(0)". Again this used to work 
with ipfwadm and then ipchains. It looks like it is not being 
handled.

Thanks - Andrew

On 17 Feb 2003 at 15:49, Dr. Arend Wellmann wrote:

> Hi!
> your script closed port 21 (ftp) where you meant to close telnet (23 is
> indeed the right port).
> However, I'd recommend you'll use a edicated proxy-server for http and
> ftp because your firewall-script allows any connetion from anywhere to
> your network.
> Hope it helps,
> Arend Wellmann 
> 
> -----Ursprüngliche Nachricht-----
> Von: linux-admin-owner@vger.kernel.org
> [mailto:linux-admin-owner@vger.kernel.org] Im Auftrag von Andrew B.
> Cramer
> Gesendet: Montag, 17. Februar 2003 14:08
> An: linux-admin
> Betreff: IP_TABLES Q
> 
> 
> 
> Hi All,
> 	Please look at this and explain where I make the mistake that
> none 
> of the workstations Masq'd are able to establish a FTP session. 
> Telnet, email, and web browsing work just fine. 
> 
> TIA - Andrew Cramer
> 
> <ip_tables commands>
> 
> #!/bin/sh
> #
> # rc.firewall-2.4
> FWVER=0.70
> #
> # Thanks to David Ranch's IPMasq HowTo
> #               Initial SIMPLE IP Masquerade test for 2.4.x kernels
> #               using IPTABLES.
> #
> 
> echo -e "\n\nLoading simple rc.firewall version $FWVER..\n"
> 
> IPTABLES=/usr/sbin/iptables
> DEPMOD=/sbin/depmod
> INSMOD=/sbin/insmod
> 
> EXTIP="xxx.yyy.zzz.1" # your external IP here.
> EXTIF="ppp0"
> INTIF="eth0"
> 
> echo "   External Interface:  $EXTIF"
> echo "   Internal Interface:  $INTIF"
> echo -en "   loading modules: "
> echo "  - Verifying that all kernel modules are ok"
> $DEPMOD -a
> 
> echo "----------------------------------------------------------------
> ------"
> echo -en "ip_tables, "
> 
> $INSMOD ip_tables
> 
> echo -en "ip_conntrack, "
> $INSMOD ip_conntrack
> 
> echo -en "iptable_nat, "
> $INSMOD iptable_nat
> 
> echo "----------------------------------------------------------------
> ------"
> 
> echo ".  Done loading modules."
> 
> echo "   enabling forwarding.."
> echo "1" > /proc/sys/net/ipv4/ip_forward
> 
> echo "   clearing any existing rules and setting default policy.."
> $IPTABLES -P INPUT ACCEPT
> $IPTABLES -F INPUT
> $IPTABLES -P OUTPUT ACCEPT
> $IPTABLES -F OUTPUT
> $IPTABLES -P FORWARD ACCEPT
> $IPTABLES -F FORWARD
> $IPTABLES -t nat -F
> 
> $IPTABLES -A INPUT -p TCP -s 0/0 --destination-port 25  -j ACCEPT
> $IPTABLES -A INPUT -p TCP -s 0/0 --destination-port 110 -j ACCEPT
> 
> # Reject telnet sessions from outside (Shouldn't it be 23 ?!?)
> $IPTABLES -A INPUT -p TCP -i $EXTIF --destination-port 21   -j REJECT
> 
> # Forward HTTPS requests  (change the port number to suit yourself)
> $IPTABLES -A FORWARD -i $EXTIF -o $INTIF -p tcp --dport 443 -m state 
> \
>    --state NEW,ESTABLISHED,RELATED -j ACCEPT
> 
> $IPTABLES -A PREROUTING -t nat -p tcp -d $EXTIP --dport 443 \
>    -j DNAT --to 192.168.1.1:443
> 
> $IPTABLES -t nat -A PREROUTING -d $EXTIP -p tcp --dport 443 \
>     -m state --state NEW,ESTABLISHED,RELATED -j DNAT --to 192.168.1.1
> 
> echo "   FWD: Allow all connections OUT and only existing and related 
> ones IN"
> $IPTABLES -A FORWARD -i $EXTIF -o $INTIF -m state --state 
> ESTABLISHED,RELATED -j ACCEPT
> $IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
> $IPTABLES -A FORWARD -j LOG
> 
> echo "   Enabling SNAT (MASQUERADE) functionality on $EXTIF"
> $IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE
> 
> echo -e "\nrc.firewall-2.4 v$FWVER done.\n"
> 
> <ip_tables Listing>
> root@home:/etc/rc.d# iptables -L
> Chain INPUT (policy ACCEPT)
> target     prot opt source               destination
> ACCEPT     tcp  --  anywhere             anywhere           tcp 
> dpt:smtp
> ACCEPT     tcp  --  anywhere             anywhere           tcp 
> dpt:pop3
> REJECT     tcp  --  anywhere             anywhere           tcp 
> dpt:ftp reject-with icmp-port-unreachable
> 
> Chain FORWARD (policy ACCEPT)
> target     prot opt source               destination
> ACCEPT     tcp  --  anywhere             anywhere           tcp 
> dpt:https state NEW,RELATED,ESTABLISHED
> ACCEPT     all  --  anywhere             anywhere           state 
> RELATED,ESTABLISHED
> ACCEPT     all  --  anywhere             anywhere
> LOG        all  --  anywhere             anywhere           LOG level 
> warning
> 
> Chain OUTPUT (policy ACCEPT)
> target     prot opt source               destination
> 
> 
> 
> 
> -
> To unsubscribe from this list: send the line "unsubscribe linux-admin"
> in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 



-
To unsubscribe from this list: send the line "unsubscribe linux-admin" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html