From: "Christian Gmeiner" <christian@visual-page.de>
To: Iptables Netlist <netfilter@lists.netfilter.org>
Subject: Fw: Problem with connection-tracking and FTP
Date: Thu, 22 Jan 2004 10:21:46 +0100 [thread overview]
Message-ID: <003801c3e0c9$28d100a0$0600a8c0@blackbox> (raw)
[-- Attachment #1: Type: text/plain, Size: 10335 bytes --]
----- Original Message -----
From: Christian Gmeiner
To: markee@bandwidthco.com
Sent: Thursday, January 22, 2004 9:17 AM
Subject: Re: Problem with connection-tracking and FTP
Hmm... this is the output of lsmod:
x-factor root # lsmod
Module Size Used by Not tainted
ipt_MASQUERADE 1496 2 (autoclean)
ipt_state 568 130 (autoclean)
ipt_unclean 7320 2 (autoclean)
ipt_LOG 3448 6 (autoclean)
ipt_limit 984 6 (autoclean)
ipt_ULOG 3656 1
ip_conntrack_ftp 4016 0 (unused)
iptable_filter 1740 1
ppp_deflate 3288 0 (autoclean)
zlib_inflate 18820 0 (autoclean) [ppp_deflate]
zlib_deflate 18872 0 (autoclean) [ppp_deflate]
bsd_comp 4248 0 (autoclean)
ppp_async 7008 1 (autoclean)
iptable_nat 18648 1 [ipt_MASQUERADE]
ip_conntrack 20776 3 [ipt_MASQUERADE ipt_state ip_conntrack_ftp iptable_nat]
ip_tables 12352 10 [ipt_MASQUERADE ipt_state ipt_unclean ipt_LOG ipt_limit ipt_ULOG iptable_filter iptable_nat]
8139too 15784 1
mii 2608 0 [8139too]
3c59x 27792 1
This seems to be ok?!
Greets, Christian
----- Original Message -----
From: Mark E. Donaldson
To: 'Christian Gmeiner' ; netfilter@lists.netfilter.org
Sent: Thursday, January 22, 2004 3:12 AM
Subject: RE: Problem with connection-tracking and FTP
Yes. That would help. Also do an lsmod to make sure all of the needed modules are loaded.
------------------------------------------------------------------------------
From: Christian Gmeiner [mailto:christian@visual-page.de]
Sent: Wednesday, January 21, 2004 3:58 AM
To: markee@bandwidthco.com; netfilter@lists.netfilter.org
Subject: Re: Problem with connection-tracking and FTP
Thanks... I have now used your rule set:
# CONTROL PORT (Active & Passive Mode)
iptables -A INPUT -i ${EXT_INT} -p tcp --source-port ${UNPRIVPORTS} --destination-port 21 -m state --state NEW -j LOG --log-prefix "FTP ACCESS -> "
iptables -A INPUT -i ${EXT_INT} -p tcp --source-port ${UNPRIVPORTS} --destination-port 21 -m state --state NEW -j ACCEPT
# DATA PORT (Active Mode)
iptables -A OUTPUT -o ${EXT_INT} -p tcp --source-port 20 --destination-port ${UNPRIVPORTS} -m state --state NEW -j LOG --log-prefix "FTP A-DATA -> "
iptables -A OUTPUT -o ${EXT_INT} -p tcp --source-port 20 --destination-port ${UNPRIVPORTS} -m state --state NEW -j ACCEPT
# DATA PORT (Passive Mode)
iptables -A INPUT -i ${EXT_INT} -p tcp --source-port ${UNPRIVPORTS} --destination-port ${UNPRIVPORTS} -m state --state NEW -j LOG --log-prefix "FTP P-DATA -> "
iptables -A INPUT -i ${EXT_INT} -p tcp --source-port ${UNPRIVPORTS} --destination-port ${UNPRIVPORTS} -m state --state NEW -j ACCEPT
I can connect to the FTP-Server and login... but then wehen the directory listening should come it hangs. I have no idea, why this is so.
Should i post the output of 'iptables -L -n -v --line-numbers'?
Thanks, Christian Gmeiner
----- Original Message -----
From: Mark E. Donaldson
To: 'Christian Gmeiner' ; netfilter@lists.netfilter.org
Sent: Wednesday, January 21, 2004 6:32 AM
Subject: RE: Problem with connection-tracking and FTP
It would appear you are assuming the FTP server will choose port 1024 for passive mode ftp. This is not correct, as it may choose any unprivileged port up to 65535. That is one problem you are having. Also, check your syntax for "passive mode". You have made an error with some not needed colons (:).
Here is a good rule set that will permit all ftp operations - active and passive:
######################
# FTP SERVICES
######################
UNPRIVPORTS="1024:65535"
# CONTROL PORT (Active & Passive Mode)
$IPT -t filter -A TCP_RULES -i $FW_INET_IFACE -p tcp --source-port $UNPRIVPORTS --destination-port 21 -m state --state NEW -j LOG --log-level $LOG_LEVEL --log-prefix "FTP ACCESS -> "
$IPT -t filter -A TCP_RULES -i $FW_INET_IFACE -p tcp --source-port $UNPRIVPORTS --destination-port 21 -m state --state NEW -j ACCEPT
# DATA PORT (Active Mode)
$IPT -t filter -A TCP_RULES -o $FW_INET_IFACE -p tcp --source-port 20 --destination-port $UNPRIVPORTS -m state --state NEW -j LOG --log-level $LOG_LEVEL --log-prefix "FTP A-DATA -> "
$IPT -t filter -A TCP_RULES -o $FW_INET_IFACE -p tcp --source-port 20 --destination-port $UNPRIVPORTS -m state --state NEW -j ACCEPT
# DATA PORT (Passive Mode)
$IPT -t filter -A TCP_RULES -i $FW_INET_IFACE -p tcp --source-port $UNPRIVPORTS --destination-port $UNPRIVPORTS -m state --state NEW -j LOG --log-level $LOG_LEVEL --log-prefix "FTP P-DATA -> "
$IPT -t filter -A TCP_RULES -i $FW_INET_IFACE -p tcp --source-port $UNPRIVPORTS --destination-port $UNPRIVPORTS -m state --state NEW -j ACCEPT
----------------------------------------------------------------------------
From: netfilter-admin@lists.netfilter.org [mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Christian Gmeiner
Sent: Tuesday, January 20, 2004 8:01 AM
To: netfilter@lists.netfilter.org
Subject: Problem with connection-tracking and FTP
Hi everybody.
I am working on a little firewall script. Everything works just fine, but i dont get the ftp protocoll working.
I call this two function to get ftp working:
# ==================================
FTP()
{
ebegin "Seting rules for active/passive FTP"
# Port 21
iptables -A INPUT -p tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
# aktiv
iptables -A INPUT -p tcp --sport 20 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 20 -m state --state ESTABLISHED -j ACCEPT
# passiv
iptables -A INPUT -p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED,RELATED -j ACCEPT
eend $?
}
# ==================================
loadmodules()
{
ebegin "Try to load needed modules"
/sbin/modprobe ip_tables
/sbin/modprobe iptable_filter
/sbin/modprobe ip_conntrack
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ipt_ULOG
eend $?
}
An here my start function
# ==================================
start()
{
ebegin "Starting Firewall"
loadmodules
einfo "Setting default rules to drop"
iptables -F
iptables -X
iptables -Z
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -P FORWARD DROP
iptables -P INPUT DROP
iptables -P OUTPUT DROP
acceptlocal
portscan
proc
iana
illigalpackages
spoofing
FTP
# set rules
InOutTCP
InTCP
OutTCP
InOutUDP
InUDP
OutUDP
# Erlaube dem Client routen durch NAT (Network Address Translation
iptables -t nat -A POSTROUTING -o ${EXT_INT} -j MASQUERADE
echo "1" > /proc/sys/net/ipv4/ip_forward
eend $? "Failed to start Firewall"
}
And here are the ports i allow with the function InOut*, In*, Out*,...
# TCP in+out
#
TCP_IN_OUT="ssh 10000 smtp pop3 http https"
# TCP out
#
# 5190 = ICQ
#
TCP_OUT="5190 http https irc 25 ftp ftp-data"
# TCP in
#
TCP_IN=""
# UDP in+out
#
UDP_IN_OUT="domain ssh 10000 pop3 ssh"
# UDP out
#
UDP_OUT="https irc"
# UDP in
#
UDP_IN=""
Oh and here some important functions:
# ==================================
InOutTCP()
{
ebegin "Allowing in and outbound TCP-traffic"
for i in ${TCP_IN_OUT}
do
einfo " <-> Seting TCP "in" and "out" rules for ${i}"
iptables -A INPUT -j ACCEPT -i ${EXT_INT} -p tcp --dport ${i} -m state --state NEW,ESTABLISHED,RELATED
iptables -A OUTPUT -j ACCEPT -o ${EXT_INT} -p tcp --sport ${i} --dport 1024: -m state --state ESTABLISHED,RELATED
iptables -A FORWARD -j ACCEPT -i ${EXT_INT} -p tcp --dport ${i} -m state --state NEW,ESTABLISHED,RELATED
iptables -A FORWARD -j ACCEPT -o ${EXT_INT} -p tcp --sport ${i} -m state --state ESTABLISHED,RELATED
iptables -A OUTPUT -j ACCEPT -o ${EXT_INT} -p tcp --sport 1024: --dport ${i} -m state --state NEW,ESTABLISHED,RELATED
iptables -A INPUT -j ACCEPT -i ${EXT_INT} -p tcp --sport ${i} -m state --state ESTABLISHED,RELATED
iptables -A FORWARD -j ACCEPT -o ${EXT_INT} -p tcp -s ${LAN} --sport 1024: --dport ${i} -m state --state NEW,ESTABLISHED,RELATED
iptables -A FORWARD -j ACCEPT -i ${EXT_INT} -p tcp --sport ${i} -d ${LAN} -m state --state ESTABLISHED,RELATED
done
eend $?
}
# ==================================
OutTCP()
{
ebegin "Allowing outbound TCP-traffic"
for i in ${TCP_OUT}
do
einfo " <-> Seting TCP "out" rules for ${i}"
iptables -A OUTPUT -j ACCEPT -o ${EXT_INT} -p tcp --sport 1024: --dport $i -m state --state NEW,ESTABLISHED,RELATED
iptables -A INPUT -j ACCEPT -i ${EXT_INT} -p tcp --sport $i -m state --state ESTABLISHED,RELATED
iptables -A FORWARD -j ACCEPT -o ${EXT_INT} -p tcp -s ${LAN} --sport 1024: --dport $i -m state --state NEW,ESTABLISHED,RELATED
iptables -A FORWARD -j ACCEPT -i ${EXT_INT} -p tcp --sport $i -d ${LAN} -m state --state ESTABLISHED,RELATED
done
eend $?
}
I hope somebody can help me.
Thanks, Christian Gmeiner
[-- Attachment #2: Type: text/html, Size: 20385 bytes --]
reply other threads:[~2004-01-22 9:21 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='003801c3e0c9$28d100a0$0600a8c0@blackbox' \
--to=christian@visual-page.de \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox