Problem seperating FTP & ms-streaming traffic

Problem seperating FTP & ms-streaming traffic

[Bo Jacobsen]

I have a problem allowing forwarding of passive internal ftp traffic and, at the
same time disallowing ms-streaming (port 1755).

Whenever I allow the passive ftp, it also allows ms-streaming going through.

My rules are:

iptables -A FORWARD -m state --state NEW,ESTABLISHED -s local_lan --sport highports --dport ftp -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -s local_lan --sport highports --dport highports -j ACCEPT

ms-streaming is a highport (1024:) but as there are no NEW in the second rule, it should
not apply to new ms-streaming connections.


Any idears 

Bo Jacobsen

Re: Problem seperating FTP & ms-streaming traffic

[Antony Stone]

On Sunday 14 March 2004 9:49 pm, Bo Jacobsen wrote:

> I have a problem allowing forwarding of passive internal ftp traffic and,
> at the same time disallowing ms-streaming (port 1755).
>
> Whenever I allow the passive ftp, it also allows ms-streaming going
> through.
>
> My rules are:
>
> iptables -A FORWARD -m state --state NEW,ESTABLISHED -s local_lan --sport
> highports --dport ftp -j ACCEPT
> iptables -A FORWARD -m state --state ESTABLISHED,RELATED -s local_lan
> --sport highports --dport highports -j ACCEPT

Those cannot be all of your rules.

Show us the rest of the rules and we might be able to suggest something.

Antony.

-- 
Normal people think "If it ain't broke, don't fix it".
Engineers think "If it ain't broke, it doesn't have enough features yet".

                                                     Please reply to the list;
                                                           please don't CC me.

Re: Problem seperating FTP & ms-streaming traffic

[Bo Jacobsen]

> > I have a problem allowing forwarding of passive internal ftp traffic and,
> > at the same time disallowing ms-streaming (port 1755).
> >
> > Whenever I allow the passive ftp, it also allows ms-streaming going
> > through.
> >
> > My rules are:
> >
> > iptables -A FORWARD -m state --state NEW,ESTABLISHED -s local_lan --sport
> > highports --dport ftp -j ACCEPT
> > iptables -A FORWARD -m state --state ESTABLISHED,RELATED -s local_lan
> > --sport highports --dport highports -j ACCEPT
> 
> Those cannot be all of your rules.
> 
> Show us the rest of the rules and we might be able to suggest something.
> 
> Antony.
> 

You are right, of course, there are a lot more rules, but those are the ones 
that opens up ms-streaming traffic. Well, the complete set of rules I use 
for passive ftp is actually:

# Accept port 21 out
iptables -A FORWARD -p tcp -m state --state NEW,ESTABLISHED -s local_lan 
--sport highports -d all_hosts --dport ftp -j ACCEPT -i eth1    # eth1 = Internal nic

#Accept reply on port 21 in
iptables -A FORWARD -p tcp -m state --state ESTABLISHED -d local_lan 
--dport highports -s all_hosts --sport ftp -j ACCEPT -i eth0    # eth0 = External nic


# Accept high-port to high-port out
iptables -A FORWARD -p tcp -m state --state ESTABLISHED,RELATED -s local_lan
--sport highports -d all_hosts --dport highports -j ACCEPT -i eth1

# Accept high-port to high-port reply in
iptables -A FORWARD -p tcp -m state --state ESTABLISHED -d local_lan
--dport highports -s all_hosts --sport highports -j ACCEPT -i eth0


When I uncomment these four iptables commands, ms-streaming passes 
through. When commented out, it does not.

I have looked at the iptables -L output, and there is no other rules that has both
source-ports and dest-ports set to highports (1024:65535).


Bo

Re: Problem seperating FTP & ms-streaming traffic

[forum]

> > > I have a problem allowing forwarding of passive internal ftp traffic
> > > and, at the same time disallowing ms-streaming (port 1755).

> You are right, of course, there are a lot more rules, but those are the
> ones that opens up ms-streaming traffic. Well, the complete set of rules
> I use for passive ftp is actually:
> 
> # Accept port 21 out

I don't understand why you need any highport/lowport stuff. I think the 
only time port numbers need to be considered are 21 and 1755 ??

ftp is something that works anyway. So isn't it just a matter of stopping 
packets heading to port 1755 (UDP/TCP)?

-- 
forum@users.pc9.org

Re: Problem seperating FTP & ms-streaming traffic

[Antony Stone]

On Monday 15 March 2004 12:57 am, Bo Jacobsen wrote:

> Well, the complete set of rules I use for passive ftp is actually:
>
> # Accept port 21 out
> iptables -A FORWARD -p tcp -m state --state NEW,ESTABLISHED -s local_lan
> --sport highports -d all_hosts --dport ftp -j ACCEPT -i eth1
>
> #Accept reply on port 21 in
> iptables -A FORWARD -p tcp -m state --state ESTABLISHED -d local_lan
> --dport highports -s all_hosts --sport ftp -j ACCEPT -i eth0
>
> # Accept high-port to high-port out
> iptables -A FORWARD -p tcp -m state --state ESTABLISHED,RELATED -s
> local_lan --sport highports -d all_hosts --dport highports -j ACCEPT -i
> eth1
>
> # Accept high-port to high-port reply in
> iptables -A FORWARD -p tcp -m state --state ESTABLISHED -d local_lan
> --dport highports -s all_hosts --sport highports -j ACCEPT -i eth0

I suggest you replace all the above rules with:

iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -p tcp -s local_lan --dport 21 -j ACCEPT

and let us know how you get on.

If that doesn't solve the problem then please (a) post your complete ruleset 
(note the word 'complete'), and (b) include all variables etc (such as 
'local_lan') so that we know how you've defined things.   The output from 
"iptables -L -nvx; iptables -L -t nat -nvx" would be good.

Regards,

Antony.

-- 
The idea that Bill Gates appeared like a knight in shining armour to lead all 
customers out of a mire of technological chaos neatly ignores the fact that 
it was he who, by peddling second-rate technology, led them into it in the 
first place.

 - Douglas Adams in The Guardian, 25th August 1995

                                                     Please reply to the list;
                                                           please don't CC me.