ip_conntrack_ftp doesn't work with ftp proxy

ip_conntrack_ftp doesn't work with ftp proxy

[Thomas Börnert]

Hello,

i hope anyone can help me.

network-chart

linuxbox ----- firewall ---- internet

on the firewall runs a ftp proxy (suse proxy-suite on port 8082)
i've the following rules

iptables -A INPUT -p tcp -s $local_net --sport 1024:65535 -d
$firewall_internal_ip --dport 8082 -m state --state NEW,ESTABLISHED -j
ACCEPT

ipatbles -A OUTPUT -p tcp -s $firewall_internal_ip --sport 8082 -d
$local_net --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT

iptables -A INPUT -p tcp -s $local_net --sport 1024:65535 -d
$firewall_internal_ip --dport 1024:65535 -m state ESTABLISHED,RELATED

.....

from the client i do the following

ftp ip_firewall 8082
login to a ftp server like redhat or so
do "ls"
then the kernel rejects the third rule written upper.

if i change the rule from RELATED to NEW, the it's working, but this
is not a solution.

Thanks for help!

- Thomas

ip_conntrack_ftp doesn't work with ftp proxy

[Thomas Boernert]

Hello,

i hope anyone can help me.

network-chart

linuxbox ----- firewall ---- internet

on the firewall runs a ftp proxy (suse proxy-suite on port 8082)
i've the following rules

iptables -A INPUT -p tcp -s $local_net --sport 1024:65535 -d
$firewall_internal_ip --dport 8082 -m state --state NEW,ESTABLISHED -j
ACCEPT

ipatbles -A OUTPUT -p tcp -s $firewall_internal_ip --sport 8082 -d
$local_net --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT

iptables -A INPUT -p tcp -s $local_net --sport 1024:65535 -d
$firewall_internal_ip --dport 1024:65535 -m state ESTABLISHED,RELATED

.....

from the client i do the following

ftp ip_firewall 8082
login to a ftp server like redhat or so
do "ls"
then the kernel rejects the third rule written upper.

if i change the rule from RELATED to NEW, the it's working, but this
is not a solution.

Thanks for help!

- Thomas

RE: ip_conntrack_ftp doesn't work with ftp proxy

[Kim Leandersson]

Try loading the ip_conntrack_ftp module with the option ports instead.

ip_conntrack_ftp ports=8082 should do the trick for you!

//kim

> -----Original Message-----
> From: Thomas Boernert [mailto:tb@tbits.net] 
> Sent: Wednesday, November 13, 2002 10:55 PM
> To: netfilter@lists.netfilter.org
> Subject: ip_conntrack_ftp doesn't work with ftp proxy
> 
> 
> Hello,
> 
> i hope anyone can help me.
> 
> network-chart
> 
> linuxbox ----- firewall ---- internet
> 
> on the firewall runs a ftp proxy (suse proxy-suite on port 
> 8082) i've the following rules
> 
> iptables -A INPUT -p tcp -s $local_net --sport 1024:65535 -d 
> $firewall_internal_ip --dport 8082 -m state --state 
> NEW,ESTABLISHED -j ACCEPT
> 
> ipatbles -A OUTPUT -p tcp -s $firewall_internal_ip --sport 
> 8082 -d $local_net --dport 1024:65535 -m state --state 
> ESTABLISHED -j ACCEPT
> 
> iptables -A INPUT -p tcp -s $local_net --sport 1024:65535 -d 
> $firewall_internal_ip --dport 1024:65535 -m state ESTABLISHED,RELATED
> 
> .....
> 
> from the client i do the following
> 
> ftp ip_firewall 8082
> login to a ftp server like redhat or so
> do "ls"
> then the kernel rejects the third rule written upper.
> 
> if i change the rule from RELATED to NEW, the it's working, 
> but this is not a solution.
> 
> Thanks for help!
> 
> - Thomas
> 
> 
> 
>