From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Christian Gmeiner" Subject: Fw: Problem with connection-tracking and FTP Date: Thu, 22 Jan 2004 10:21:46 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: <003801c3e0c9$28d100a0$0600a8c0@blackbox> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0035_01C3E0D1.89E77560" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: Iptables Netlist This is a multi-part message in MIME format. ------=_NextPart_000_0035_01C3E0D1.89E77560 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable ----- Original Message -----=20 From: Christian Gmeiner=20 To: markee@bandwidthco.com=20 Sent: Thursday, January 22, 2004 9:17 AM Subject: Re: Problem with connection-tracking and FTP Hmm... this is the output of lsmod: x-factor root # lsmod Module Size Used by Not tainted ipt_MASQUERADE 1496 2 (autoclean) ipt_state 568 130 (autoclean) ipt_unclean 7320 2 (autoclean) ipt_LOG 3448 6 (autoclean) ipt_limit 984 6 (autoclean) ipt_ULOG 3656 1 ip_conntrack_ftp 4016 0 (unused) iptable_filter 1740 1 ppp_deflate 3288 0 (autoclean) zlib_inflate 18820 0 (autoclean) [ppp_deflate] zlib_deflate 18872 0 (autoclean) [ppp_deflate] bsd_comp 4248 0 (autoclean) ppp_async 7008 1 (autoclean) iptable_nat 18648 1 [ipt_MASQUERADE] ip_conntrack 20776 3 [ipt_MASQUERADE ipt_state = ip_conntrack_ftp iptable_nat] ip_tables 12352 10 [ipt_MASQUERADE ipt_state ipt_unclean = ipt_LOG ipt_limit ipt_ULOG iptable_filter iptable_nat] 8139too 15784 1 mii 2608 0 [8139too] 3c59x 27792 1 This seems to be ok?! Greets, Christian ----- Original Message -----=20 From: Mark E. Donaldson=20 To: 'Christian Gmeiner' ; netfilter@lists.netfilter.org=20 Sent: Thursday, January 22, 2004 3:12 AM Subject: RE: Problem with connection-tracking and FTP Yes. That would help. Also do an lsmod to make sure all of the = needed modules are loaded. -------------------------------------------------------------------------= ----- From: Christian Gmeiner [mailto:christian@visual-page.de]=20 Sent: Wednesday, January 21, 2004 3:58 AM To: markee@bandwidthco.com; netfilter@lists.netfilter.org Subject: Re: Problem with connection-tracking and FTP Thanks... I have now used your rule set: # CONTROL PORT (Active & Passive Mode) iptables -A INPUT -i ${EXT_INT} -p tcp --source-port = ${UNPRIVPORTS} --destination-port 21 -m state --state NEW -j LOG = --log-prefix "FTP ACCESS -> " iptables -A INPUT -i ${EXT_INT} -p tcp --source-port = ${UNPRIVPORTS} --destination-port 21 -m state --state NEW -j ACCEPT =20 # DATA PORT (Active Mode) iptables -A OUTPUT -o ${EXT_INT} -p tcp --source-port 20 = --destination-port ${UNPRIVPORTS} -m state --state NEW -j LOG = --log-prefix "FTP A-DATA -> " iptables -A OUTPUT -o ${EXT_INT} -p tcp --source-port 20 = --destination-port ${UNPRIVPORTS} -m state --state NEW -j ACCEPT =20 # DATA PORT (Passive Mode) iptables -A INPUT -i ${EXT_INT} -p tcp --source-port = ${UNPRIVPORTS} --destination-port ${UNPRIVPORTS} -m state --state NEW -j = LOG --log-prefix "FTP P-DATA -> " iptables -A INPUT -i ${EXT_INT} -p tcp --source-port = ${UNPRIVPORTS} --destination-port ${UNPRIVPORTS} -m state --state NEW -j = ACCEPT I can connect to the FTP-Server and login... but then wehen the = directory listening should come it hangs. I have no idea, why this is = so. Should i post the output of 'iptables -L -n -v --line-numbers'? Thanks, Christian Gmeiner ----- Original Message -----=20 From: Mark E. Donaldson=20 To: 'Christian Gmeiner' ; netfilter@lists.netfilter.org=20 Sent: Wednesday, January 21, 2004 6:32 AM Subject: RE: Problem with connection-tracking and FTP It would appear you are assuming the FTP server will choose port = 1024 for passive mode ftp. This is not correct, as it may choose any = unprivileged port up to 65535. That is one problem you are having. = Also, check your syntax for "passive mode". You have made an error with = some not needed colons (:). Here is a good rule set that will permit all ftp operations - active = and passive: ###################### # FTP SERVICES ###################### UNPRIVPORTS=3D"1024:65535" # CONTROL PORT (Active & Passive Mode) $IPT -t filter -A TCP_RULES -i $FW_INET_IFACE -p tcp --source-port = $UNPRIVPORTS --destination-port 21 -m state --state NEW -j LOG = --log-level $LOG_LEVEL --log-prefix "FTP ACCESS -> " $IPT -t filter -A TCP_RULES -i $FW_INET_IFACE -p tcp --source-port = $UNPRIVPORTS --destination-port 21 -m state --state NEW -j ACCEPT # DATA PORT (Active Mode) $IPT -t filter -A TCP_RULES -o $FW_INET_IFACE -p tcp --source-port = 20 --destination-port $UNPRIVPORTS -m state --state NEW -j LOG = --log-level $LOG_LEVEL --log-prefix "FTP A-DATA -> " $IPT -t filter -A TCP_RULES -o $FW_INET_IFACE -p tcp --source-port = 20 --destination-port $UNPRIVPORTS -m state --state NEW -j ACCEPT # DATA PORT (Passive Mode) $IPT -t filter -A TCP_RULES -i $FW_INET_IFACE -p tcp --source-port = $UNPRIVPORTS --destination-port $UNPRIVPORTS -m state --state NEW -j LOG = --log-level $LOG_LEVEL --log-prefix "FTP P-DATA -> " $IPT -t filter -A TCP_RULES -i $FW_INET_IFACE -p tcp --source-port = $UNPRIVPORTS --destination-port $UNPRIVPORTS -m state --state NEW -j = ACCEPT -------------------------------------------------------------------------= --- From: netfilter-admin@lists.netfilter.org = [mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Christian = Gmeiner Sent: Tuesday, January 20, 2004 8:01 AM To: netfilter@lists.netfilter.org Subject: Problem with connection-tracking and FTP Hi everybody. I am working on a little firewall script. Everything works just = fine, but i dont get the ftp protocoll working. I call this two function to get ftp working: # = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D FTP() { ebegin "Seting rules for active/passive FTP" # Port 21 iptables -A INPUT -p tcp --sport 21 -m state --state = ESTABLISHED -j ACCEPT=20 iptables -A OUTPUT -p tcp --dport 21 -m state --state = NEW,ESTABLISHED -j ACCEPT=20 # aktiv iptables -A INPUT -p tcp --sport 20 -m state --state = ESTABLISHED,RELATED -j ACCEPT=20 iptables -A OUTPUT -p tcp --dport 20 -m state --state = ESTABLISHED -j ACCEPT=20 # passiv iptables -A INPUT -p tcp --sport 1024: --dport 1024: -m = state --state ESTABLISHED -j ACCEPT=20 iptables -A OUTPUT -p tcp --sport 1024: --dport 1024: -m state = --state ESTABLISHED,RELATED -j ACCEPT=20 eend $? } # = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D loadmodules() { ebegin "Try to load needed modules" /sbin/modprobe ip_tables /sbin/modprobe iptable_filter /sbin/modprobe ip_conntrack /sbin/modprobe ip_conntrack_ftp /sbin/modprobe ipt_ULOG eend $? } An here my start function # = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D start()=20 { ebegin "Starting Firewall" loadmodules einfo "Setting default rules to drop" iptables -F iptables -X=20 iptables -Z=20 iptables -F INPUT iptables -F OUTPUT iptables -F FORWARD iptables -P FORWARD DROP iptables -P INPUT DROP iptables -P OUTPUT DROP acceptlocal portscan proc iana illigalpackages spoofing FTP # set rules InOutTCP InTCP OutTCP InOutUDP InUDP OutUDP # Erlaube dem Client routen durch NAT (Network Address = Translation iptables -t nat -A POSTROUTING -o ${EXT_INT} -j MASQUERADE echo "1" > /proc/sys/net/ipv4/ip_forward eend $? "Failed to start Firewall" } And here are the ports i allow with the function InOut*, In*, = Out*,... # TCP in+out # TCP_IN_OUT=3D"ssh 10000 smtp pop3 http https" # TCP out # # 5190 =3D ICQ # TCP_OUT=3D"5190 http https irc 25 ftp ftp-data" # TCP in # TCP_IN=3D"" # UDP in+out # UDP_IN_OUT=3D"domain ssh 10000 pop3 ssh" # UDP out # UDP_OUT=3D"https irc" # UDP in # UDP_IN=3D"" Oh and here some important functions: # = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D InOutTCP() { ebegin "Allowing in and outbound TCP-traffic" for i in ${TCP_IN_OUT} do einfo " <-> Seting TCP "in" and "out" rules for ${i}" iptables -A INPUT -j ACCEPT -i ${EXT_INT} -p tcp --dport = ${i} -m state --state NEW,ESTABLISHED,RELATED iptables -A OUTPUT -j ACCEPT -o ${EXT_INT} -p tcp --sport = ${i} --dport 1024: -m state --state ESTABLISHED,RELATED iptables -A FORWARD -j ACCEPT -i ${EXT_INT} -p tcp --dport = ${i} -m state --state NEW,ESTABLISHED,RELATED iptables -A FORWARD -j ACCEPT -o ${EXT_INT} -p tcp --sport = ${i} -m state --state ESTABLISHED,RELATED iptables -A OUTPUT -j ACCEPT -o ${EXT_INT} -p tcp --sport = 1024: --dport ${i} -m state --state NEW,ESTABLISHED,RELATED iptables -A INPUT -j ACCEPT -i ${EXT_INT} -p tcp --sport = ${i} -m state --state ESTABLISHED,RELATED iptables -A FORWARD -j ACCEPT -o ${EXT_INT} -p tcp -s ${LAN} = --sport 1024: --dport ${i} -m state --state NEW,ESTABLISHED,RELATED iptables -A FORWARD -j ACCEPT -i ${EXT_INT} -p tcp --sport = ${i} -d ${LAN} -m state --state ESTABLISHED,RELATED done eend $? } # = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=20 OutTCP() { ebegin "Allowing outbound TCP-traffic" for i in ${TCP_OUT} do einfo " <-> Seting TCP "out" rules for ${i}" iptables -A OUTPUT -j ACCEPT -o ${EXT_INT} -p tcp --sport = 1024: --dport $i -m state --state NEW,ESTABLISHED,RELATED iptables -A INPUT -j ACCEPT -i ${EXT_INT} -p tcp --sport $i = -m state --state ESTABLISHED,RELATED iptables -A FORWARD -j ACCEPT -o ${EXT_INT} -p tcp -s ${LAN} = --sport 1024: --dport $i -m state --state NEW,ESTABLISHED,RELATED iptables -A FORWARD -j ACCEPT -i ${EXT_INT} -p tcp --sport = $i -d ${LAN} -m state --state ESTABLISHED,RELATED done eend $? } I hope somebody can help me. Thanks, Christian Gmeiner ------=_NextPart_000_0035_01C3E0D1.89E77560 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
 
----- Original Message -----=20
From: Christian=20 Gmeiner
Sent: Thursday, January 22, 2004 9:17 AM
Subject: Re: Problem with connection-tracking and = FTP

Hmm... this is the output of = lsmod:
 
x-factor root #=20 lsmod
Module         &nbs= p;       =20 Size  Used by    Not=20 tainted
ipt_MASQUERADE        =  =20 1496   2 =20 (autoclean)
ipt_state        &= nbsp;      =20 568 130 =20 (autoclean)
ipt_unclean        = ;    =20 7320   2 =20 (autoclean)
ipt_LOG        &nb= sp;       =20 3448   6 =20 (autoclean)
ipt_limit        &= nbsp;      =20 984   6 =20 (autoclean)
ipt_ULOG        &n= bsp;      =20 3656   = 1
ip_conntrack_ftp       =20 4016   0 =20 (unused)
iptable_filter        = ; =20 1740  =20 1
ppp_deflate         &nb= sp;  =20 3288   0 =20 (autoclean)
zlib_inflate       &nbs= p;  =20 18820   0  (autoclean)=20 [ppp_deflate]
zlib_deflate       &n= bsp;  =20 18872   0  (autoclean)=20 [ppp_deflate]
bsd_comp        =        =20 4248   0 =20 (autoclean)
ppp_async        &= nbsp;     =20 7008   1 =20 (autoclean)
iptable_nat        = ;   =20 18648   1 =20 [ipt_MASQUERADE]
ip_conntrack       = ;   =20 20776   3  [ipt_MASQUERADE ipt_state ip_conntrack_ftp=20 iptable_nat]
ip_tables        =      =20 12352  10  [ipt_MASQUERADE ipt_state ipt_unclean ipt_LOG = ipt_limit=20 ipt_ULOG iptable_filter=20 iptable_nat]
8139too        &n= bsp;      =20 15784  =20 1
mii           = ;         =20 2608   0 =20 [8139too]
3c59x         &= nbsp;       =20 27792   1
This seems to be ok?!
 
Greets, Christian
 
----- Original Message -----
From:=20 Mark E.=20 Donaldson
To: 'Christian Gmeiner' ; netfilter@lists.netfilter.o= rg=20
Sent: Thursday, January 22, = 2004 3:12=20 AM
Subject: RE: Problem with=20 connection-tracking and FTP

Yes.  That would help.  Also do an = lsmod to=20 make sure all of the needed modules are = loaded.

From: Christian Gmeiner=20 [mailto:christian@visual-page.de]
Sent: Wednesday, January = 21, 2004=20 3:58 AM
To: markee@bandwidthco.com; netfilter@lists.netfilter.o= rg
Subject:=20 Re: Problem with connection-tracking and FTP

Thanks... I have now used your rule=20 set:
 
    # CONTROL PORT = (Active &=20 Passive Mode)
    iptables -A INPUT -i ${EXT_INT} -p = tcp=20 --source-port ${UNPRIVPORTS} --destination-port 21 -m state --state = NEW -j LOG=20 --log-prefix "FTP ACCESS -> "
    iptables -A = INPUT -i=20 ${EXT_INT} -p tcp --source-port ${UNPRIVPORTS} --destination-port 21 = -m state=20 --state NEW -j ACCEPT
 
    # DATA PORT = (Active=20 Mode)
    iptables -A OUTPUT -o ${EXT_INT} -p tcp=20 --source-port 20 --destination-port ${UNPRIVPORTS} -m state --state = NEW -j=20 LOG  --log-prefix "FTP A-DATA -> "
    = iptables -A=20 OUTPUT -o ${EXT_INT} -p tcp --source-port 20 --destination-port = ${UNPRIVPORTS}=20 -m state --state NEW -j ACCEPT
 
    # DATA = PORT=20 (Passive Mode)
    iptables -A INPUT -i ${EXT_INT} = -p tcp=20 --source-port ${UNPRIVPORTS} --destination-port ${UNPRIVPORTS} -m = state=20 --state NEW -j LOG --log-prefix "FTP P-DATA -> = "
   =20 iptables -A INPUT -i ${EXT_INT} -p tcp --source-port ${UNPRIVPORTS}=20 --destination-port ${UNPRIVPORTS} -m state --state NEW -j = ACCEPT
 
I can connect to the FTP-Server and = login... but=20 then wehen the directory listening should come it hangs. I have no = idea, why=20 this is so.
Should i post the output = of 'iptables -L -n=20 -v --line-numbers'?
 
Thanks, Christian = Gmeiner
 
----- Original Message -----
From:=20 Mark E.=20 Donaldson
To: 'Christian Gmeiner' ; = netfilter@lists.netfilter.o= rg=20
Sent: Wednesday, January 21, = 2004 6:32=20 AM
Subject: RE: Problem with=20 connection-tracking and FTP

It would appear you are assuming the FTP = server=20 will choose port 1024 for passive mode ftp.  This is not = correct, as it=20 may choose any unprivileged port up to 65535.  That is one = problem you=20 are having.  Also, check your syntax for "passive mode".  = You have=20 made an error with some not needed colons (:).
Here is a good rule set that will permit = all ftp=20 operations - active and passive:
 
######################
# FTP=20 SERVICES
######################
UNPRIVPORTS=3D"1024:65535"
 
# CONTROL PORT=20 (Active & Passive Mode)
$IPT -t filter=20 -A TCP_RULES -i $FW_INET_IFACE -p tcp --source-port $UNPRIVPORTS=20 --destination-port 21 -m state --state NEW -j LOG --log-level = $LOG_LEVEL=20 --log-prefix "FTP ACCESS -> "
$IPT -t filter=20 -A TCP_RULES -i $FW_INET_IFACE -p tcp --source-port $UNPRIVPORTS=20 --destination-port 21 -m state --state NEW -j ACCEPT
 
# DATA PORT=20 (Active Mode)
$IPT -t filter -A TCP_RULES -o $FW_INET_IFACE -p = tcp=20 --source-port 20 --destination-port $UNPRIVPORTS -m state --state = NEW -j LOG=20 --log-level $LOG_LEVEL --log-prefix "FTP A-DATA -> = "
$IPT -t filter=20 -A TCP_RULES -o $FW_INET_IFACE -p tcp --source-port 20 = --destination-port=20 $UNPRIVPORTS -m state --state NEW -j ACCEPT
 
# DATA PORT=20 (Passive Mode)
$IPT -t filter -A TCP_RULES -i $FW_INET_IFACE -p = tcp=20 --source-port $UNPRIVPORTS --destination-port $UNPRIVPORTS -m state = --state=20 NEW -j LOG --log-level $LOG_LEVEL --log-prefix "FTP P-DATA ->=20 "
$IPT -t filter=20 -A TCP_RULES -i $FW_INET_IFACE -p tcp --source-port $UNPRIVPORTS=20 --destination-port $UNPRIVPORTS -m state --state NEW -j=20 ACCEPT

From: = netfilter-admin@lists.netfilter.org=20 [mailto:netfilter-admin@lists.netfilter.org] On Behalf Of = Christian=20 Gmeiner
Sent: Tuesday, January 20, 2004 8:01 = AM
To:=20 netfilter@lists.netfilter.org
Subject: Problem with=20 connection-tracking and FTP

Hi everybody.
 
I am working on a little firewall = script.=20 Everything works just fine, but i dont get the ftp protocoll=20 working.
 
I call this two function to get ftp = working:
 
#=20 = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D
FTP()
{
   =20 ebegin "Seting rules for active/passive FTP"
 
    # Port = 21
 
    iptables -A=20 INPUT     -p tcp --sport 21 -m state --state = ESTABLISHED=20 -j ACCEPT
    iptables -A OUTPUT -p tcp --dport = 21 -m=20 state --state NEW,ESTABLISHED -j ACCEPT
 
    #=20 aktiv
    iptables -A = INPUT     -p tcp=20 --sport 20 -m state --state ESTABLISHED,RELATED -j ACCEPT=20
    iptables -A OUTPUT -p tcp --dport 20 -m state = --state=20 ESTABLISHED -j ACCEPT
 
    #=20 passiv
    iptables -A = INPUT     -p=20 tcp --sport 1024: --dport 1024:  -m state --state ESTABLISHED = -j ACCEPT=20
    iptables -A OUTPUT -p tcp --sport 1024: = --dport=20 1024:  -m state --state ESTABLISHED,RELATED -j ACCEPT =
 
    eend = $?
}
 

#=20 = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D
loadmodules()
{
   =20 ebegin "Try to load needed modules"
 
    /sbin/modprobe = ip_tables
   =20 /sbin/modprobe iptable_filter
    /sbin/modprobe=20 ip_conntrack
    /sbin/modprobe=20 ip_conntrack_ftp
    /sbin/modprobe=20 ipt_ULOG
    eend $?
}
 
An here my start function
# = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D
start()=20
{
    ebegin "Starting Firewall"
 
    loadmodules
 
    einfo "Setting default rules to=20 drop"
    iptables -F
    = iptables -X=20
    iptables -Z
    iptables = -F=20 INPUT
    iptables -F OUTPUT
    = iptables -F FORWARD
 
    iptables -P FORWARD = DROP
   =20 iptables -P INPUT   DROP
    iptables -P = OUTPUT  DROP
 
    acceptlocal
   =20 portscan
    proc
   =20 iana
    illigalpackages
   =20 spoofing
    FTP
 
    # set rules
   =20 InOutTCP
    InTCP
   =20 OutTCP
    InOutUDP
   =20 InUDP
    OutUDP
 
    # Erlaube dem Client routen durch NAT = (Network=20 Address Translation
    iptables -t nat -A = POSTROUTING -o=20 ${EXT_INT} -j MASQUERADE
    echo "1" >=20 /proc/sys/net/ipv4/ip_forward
 
    eend $? "Failed to start = Firewall"
}
 
 
And here are the ports i allow with the function InOut*, In*,=20 Out*,...
 
# TCP in+out
#
TCP_IN_OUT=3D"ssh 10000 smtp pop3 http = https"
 
# TCP out
#
# 5190 =3D ICQ
#
TCP_OUT=3D"5190 http = https irc 25=20 ftp ftp-data"
 
# TCP in
#
TCP_IN=3D""
 
# UDP in+out
#
UDP_IN_OUT=3D"domain ssh 10000 pop3 = ssh"
 
# UDP out
#
UDP_OUT=3D"https irc"
 
# UDP in
#
UDP_IN=3D""
 
 
Oh and here some important functions:
 
#=20 = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D
InOutTCP()
{
   =20 ebegin "Allowing in and outbound TCP-traffic"
 
    for i in ${TCP_IN_OUT}
    = do
        einfo "   = <-> Seting TCP "in" and "out" rules for ${i}"
 
        iptables -A = INPUT  -j=20 ACCEPT -i ${EXT_INT} -p tcp --dport ${i} -m state --state=20 = NEW,ESTABLISHED,RELATED
       =20 iptables -A OUTPUT -j ACCEPT -o ${EXT_INT} -p tcp --sport ${i} = --dport 1024:=20 -m state --state=20 ESTABLISHED,RELATED
        = iptables=20 -A FORWARD  -j ACCEPT -i ${EXT_INT} -p tcp --dport ${i} -m = state=20 --state=20 = NEW,ESTABLISHED,RELATED
       =20 iptables -A FORWARD -j ACCEPT -o ${EXT_INT} -p tcp --sport ${i} -m = state=20 --state ESTABLISHED,RELATED
 
        iptables -A OUTPUT = -j ACCEPT=20 -o ${EXT_INT} -p tcp --sport 1024: --dport ${i} -m state --state=20 = NEW,ESTABLISHED,RELATED
       =20 iptables -A INPUT  -j ACCEPT -i ${EXT_INT} -p tcp --sport ${i} = -m state=20 --state = ESTABLISHED,RELATED
       =20 iptables -A FORWARD -j ACCEPT -o ${EXT_INT} -p tcp -s ${LAN} --sport = 1024:=20 --dport ${i} -m state --state=20 = NEW,ESTABLISHED,RELATED
       =20 iptables -A FORWARD  -j ACCEPT -i ${EXT_INT} -p tcp --sport = ${i} -d=20 ${LAN} -m state --state ESTABLISHED,RELATED
    = done
 
    eend $?
}
 
# = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=20
OutTCP()
{
    ebegin "Allowing outbound=20 TCP-traffic"
 
    for i in ${TCP_OUT}
   =20 do
        einfo "   = <-> Seting TCP "out" rules for ${i}"
 
        iptables -A OUTPUT = -j ACCEPT=20 -o ${EXT_INT} -p tcp --sport 1024: --dport $i -m state --state=20 = NEW,ESTABLISHED,RELATED
       =20 iptables -A INPUT  -j ACCEPT -i ${EXT_INT} -p tcp --sport $i -m = state=20 --state = ESTABLISHED,RELATED
       =20 iptables -A FORWARD -j ACCEPT -o ${EXT_INT} -p tcp -s ${LAN} --sport = 1024:=20 --dport $i -m state --state=20 = NEW,ESTABLISHED,RELATED
       =20 iptables -A FORWARD  -j ACCEPT -i ${EXT_INT} -p tcp --sport $i = -d=20 ${LAN} -m state --state ESTABLISHED,RELATED
    = done
 
    eend $?
}
 
I hope somebody can help me.
 
Thanks, Christian Gmeiner
 
=
 
------=_NextPart_000_0035_01C3E0D1.89E77560--