Broken ftp through iptables

Broken ftp through iptables

[Landon Chelf]

Hello,

I've ran into a recent problem both on rh8 and rh9 using iptables.  I've
setup my firewall to drop everything incomming and forward and am only
allowing certain ports to be open.  I've opened ftp (port 21 tcp) and I
can connect via FTP from one machine and authenticate, but when I issue
my first command like "ls" for instance the connection locks up and
won't do anything.  Is there a way to fix this?

Landon

RE: Broken ftp through iptables

[Landon Chelf]

Thanks but it is loaded from what I can tell.  Below is the iptables
stuff of an lsmod

Module                  Size  Used by    Not tainted
ip_conntrack_ftp        5296   0  (unused)
ip_conntrack           26976   1  [ip_conntrack_ftp]
iptable_filter          2412   1  (autoclean)
ip_tables              15096   1  [iptable_filter]

-----Original Message-----
From: Jamie Pratt [mailto:jamie@nucdc.org] 
Sent: Tuesday, August 26, 2003 11:31 AM
To: Landon Chelf
Subject: Re: Broken ftp through iptables


hi - do you have the ip_conntrack_ftp module loaded on the server? 
(lsmod command will show you all the modules that are currently 
loaded).. - if not, try putting 'insmod ip_conntrack_ftp' in your 
script.. (near the top obviously ;-)

jamie

Landon Chelf wrote:

> Hello,
> 
> I've ran into a recent problem both on rh8 and rh9 using iptables.  
> I've setup my firewall to drop everything incomming and forward and am

> only allowing certain ports to be open.  I've opened ftp (port 21 tcp)

> and I can connect via FTP from one machine and authenticate, but when 
> I issue my first command like "ls" for instance the connection locks 
> up and won't do anything.  Is there a way to fix this?
> 
> Landon
> 
> 
> 
> 

Re: Broken ftp through iptables

[Peter Marshall]

If you want to use passive ftp you have to allow stuff destined to port 21
and you also have to allow ( for the commands) traffic to come in on some
port that you don't get to pick.  The way to to this without actually
opening a whole bunch of ports is like this

From inside network going out and on forward chain
    -p tcp --dport  21 -j ACCEPT
    -p tcp -m state --state RELATED - j ACCEPT

FROM outside network back in on the Forward chain
   -p tcp -m state --state ESTABLISHED -j ACCEPT


If you want to do Active ftp .... well .... trust me, you dont want to do
this :)


----- Original Message -----
From: "Landon Chelf" <landonc@starrobbins.com>
To: <netfilter@lists.netfilter.org>
Sent: Tuesday, August 26, 2003 12:21 PM
Subject: Broken ftp through iptables


> Hello,
>
> I've ran into a recent problem both on rh8 and rh9 using iptables.  I've
> setup my firewall to drop everything incomming and forward and am only
> allowing certain ports to be open.  I've opened ftp (port 21 tcp) and I
> can connect via FTP from one machine and authenticate, but when I issue
> my first command like "ls" for instance the connection locks up and
> won't do anything.  Is there a way to fix this?
>
> Landon
>
>

Re: Broken ftp through iptables

[Julian Gomez]

On Tue, Aug 26, 2003 at 11:42:02AM -0400, Landon Chelf spoke thusly:
>Thanks but it is loaded from what I can tell.  Below is the iptables
>stuff of an lsmod
>
>Module                  Size  Used by    Not tainted
>ip_conntrack_ftp        5296   0  (unused)
>ip_conntrack           26976   1  [ip_conntrack_ftp]
>iptable_filter          2412   1  (autoclean)
>ip_tables              15096   1  [iptable_filter]

You have a corresponding --state RELATED rule ?

(snip remaining)

RE: Broken ftp through iptables

[Landon Chelf]

Thanx,

I was missing the following line.  All seems to be good now.  Thanx for
the help.

-p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT

Landon

-----Original Message-----
From: Peter Marshall [mailto:peter.marshall@caris.com] 
Sent: Tuesday, August 26, 2003 12:00 PM
To: Landon Chelf; netfilter@lists.netfilter.org
Subject: Re: Broken ftp through iptables


If you want to use passive ftp you have to allow stuff destined to port
21 and you also have to allow ( for the commands) traffic to come in on
some port that you don't get to pick.  The way to to this without
actually opening a whole bunch of ports is like this

From inside network going out and on forward chain
    -p tcp --dport  21 -j ACCEPT
    -p tcp -m state --state RELATED - j ACCEPT

FROM outside network back in on the Forward chain
   -p tcp -m state --state ESTABLISHED -j ACCEPT


If you want to do Active ftp .... well .... trust me, you dont want to
do this :)


----- Original Message -----
From: "Landon Chelf" <landonc@starrobbins.com>
To: <netfilter@lists.netfilter.org>
Sent: Tuesday, August 26, 2003 12:21 PM
Subject: Broken ftp through iptables


> Hello,
>
> I've ran into a recent problem both on rh8 and rh9 using iptables.  
> I've setup my firewall to drop everything incomming and forward and am

> only allowing certain ports to be open.  I've opened ftp (port 21 tcp)

> and I can connect via FTP from one machine and authenticate, but when 
> I issue my first command like "ls" for instance the connection locks 
> up and won't do anything.  Is there a way to fix this?
>
> Landon
>
>

Re: Broken ftp through iptables

[Peter Marshall]

Read this page.  It will explaine why I have what I do.  ( well actually it
just explaines how the connections in ftp work ...  but from that you should
be able to determine what the problem is :)

http://slacksite.com/other/ftp.html


----- Original Message -----
From: "Julian Gomez" <kluivert@tm.net.my>
To: <netfilter@lists.netfilter.org>
Sent: Tuesday, August 26, 2003 1:05 PM
Subject: Re: Broken ftp through iptables


> On Tue, Aug 26, 2003 at 11:42:02AM -0400, Landon Chelf spoke thusly:
> >Thanks but it is loaded from what I can tell.  Below is the iptables
> >stuff of an lsmod
> >
> >Module                  Size  Used by    Not tainted
> >ip_conntrack_ftp        5296   0  (unused)
> >ip_conntrack           26976   1  [ip_conntrack_ftp]
> >iptable_filter          2412   1  (autoclean)
> >ip_tables              15096   1  [iptable_filter]
>
> You have a corresponding --state RELATED rule ?
>
> (snip remaining)
>

Re: Broken ftp through iptables

[Alistair Tonner]

	And recall that this will only work if the FTP port is the standard FTP port.

	If you are using a NON-standard ftp port, you need to pass the ports=21,xx
	option to both modules.

On August 26, 2003 11:42 am, Landon Chelf wrote:
> Thanks but it is loaded from what I can tell.  Below is the iptables
> stuff of an lsmod
>
> Module                  Size  Used by    Not tainted
> ip_conntrack_ftp        5296   0  (unused)
> ip_conntrack           26976   1  [ip_conntrack_ftp]
> iptable_filter          2412   1  (autoclean)
> ip_tables              15096   1  [iptable_filter]
>
> -----Original Message-----
> From: Jamie Pratt [mailto:jamie@nucdc.org]
> Sent: Tuesday, August 26, 2003 11:31 AM
> To: Landon Chelf
> Subject: Re: Broken ftp through iptables
>
>
> hi - do you have the ip_conntrack_ftp module loaded on the server?
> (lsmod command will show you all the modules that are currently
> loaded).. - if not, try putting 'insmod ip_conntrack_ftp' in your
> script.. (near the top obviously ;-)
>
> jamie
>
> Landon Chelf wrote:
> > Hello,
> >
> > I've ran into a recent problem both on rh8 and rh9 using iptables.
> > I've setup my firewall to drop everything incomming and forward and am
> >
> > only allowing certain ports to be open.  I've opened ftp (port 21 tcp)
> >
> > and I can connect via FTP from one machine and authenticate, but when
> > I issue my first command like "ls" for instance the connection locks
> > up and won't do anything.  Is there a way to fix this?
> >
> > Landon

-- 

	Alistair Tonner
	nerdnet.ca
	Senior Systems Analyst - RSS
	
     Any sufficiently advanced technology will have the appearance of magic.
	Lets get magical!

RE: Broken ftp through iptables

[Josh.Berry]

[-- Attachment #1: Type: text/plain, Size: 822 bytes --]

The ls command is usually the data portion of the FTP connection.  Have you tried changing the mode to passive (or to active if you are already using passive)?

	-----Original Message----- 
	From: Landon Chelf [mailto:landonc@starrobbins.com] 
	Sent: Tue 8/26/2003 10:21 AM 
	To: netfilter@lists.netfilter.org 
	Cc: 
	Subject: Broken ftp through iptables
	
	

	Hello,
	
	I've ran into a recent problem both on rh8 and rh9 using iptables.  I've
	setup my firewall to drop everything incomming and forward and am only
	allowing certain ports to be open.  I've opened ftp (port 21 tcp) and I
	can connect via FTP from one machine and authenticate, but when I issue
	my first command like "ls" for instance the connection locks up and
	won't do anything.  Is there a way to fix this?
	
	Landon
	
	
	


[-- Attachment #2: Type: text/html, Size: 1334 bytes --]