* Re: ftp again
@ 2004-05-22 22:28 azeem ahmad
2004-05-22 22:50 ` Antony Stone
2004-06-15 14:35 ` Peter Marshall
0 siblings, 2 replies; 7+ messages in thread
From: azeem ahmad @ 2004-05-22 22:28 UTC (permalink / raw)
To: netfilter
i issued the commands
#modprobe ip_nat_ftp
#modprobe ip_conntrack_ftp
and now it works well
but what are these modules and what is the connection tracking. can u tell
me about any usefull link
Regards
Azeem
>From: Antony Stone <Antony@Soft-Solutions.co.uk>
>Reply-To: netfilter@lists.netfilter.org
>To: netfilter@lists.netfilter.org
>Subject: Re: ftp again
>Date: Sat, 22 May 2004 16:56:16 +0100
>
>On Saturday 22 May 2004 4:29 pm, azeem ahmad wrote:
>
> > hi all
> > when i run this script on my box the natting of ftp stops. neither
>clients
> > browse in non-paasive mode nor in passive mode
> > what is the problem
>
>Perhaps you do not have the nat_ftp and conntrack_ftp modules loaded or
>compiled into your kernel?
>
> > iptables -F
> > iptables -t nat -F
> > iptables -P INPUT DROP
> > iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
> > iptables -A INPUT -i eth0 -p tcp --dport 8080 -j ACCEPT
> > iptables -A INPUT -i eth0 -p udp --dport 8080 -j ACCEPT
>
>What are you using UDP port 8080 for?
>
> > iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT
> > iptables -A INPUT -i eth0 -p tcp --dport 53 -j ACCEPT
> > iptables -A INPUT -i eth0 -p udp --dport 53 -j ACCEPT
> > iptables -A INPUT -i eth0 -p udp --dport 137 -j ACCEPT
> > iptables -A INPUT -i eth0 -p udp --dport 138 -j ACCEPT
> > iptables -A INPUT -i eth0 -p tcp --dport 139 -j ACCEPT
> >
> > iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port
>8080
> > iptables -t nat -A PREROUTING -p udp --dport 80 -j REDIRECT --to-port
>8080
>
>Same question as above...
>
> > iptables -P FORWARD DROP
> > iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
> > iptables -A FORWARD -i eth0 -p tcp --dport 20 -j ACCEPT
> > iptables -A FORWARD -i eth0 -p udp --dport 20 -j ACCEPT
> > iptables -A FORWARD -i eth0 -p tcp --dport 21 -j ACCEPT
> > iptables -A FORWARD -i eth0 -p udp --dport 21 -j ACCEPT
>
>FTP does not use UDP, so two of the above four rules are irrelevant, and
>stateful packet filtering (which you are clearly using from the first rule
>in
>your FORWARD chain) means that you do not need a rule for the data
>connection
>on TCP port 20 - therefore you only need one of the above four rules:
>
>iptables -A FORWARD -i eth0 -p tcp --dport 21 -j ACCEPT
>
> > iptables -A FORWARD -i eth0 -p tcp --dport 443 -j ACCEPT
> > iptables -A FORWARD -i eth0 -p tcp --dport 5000 -j ACCEPT
> > iptables -A FORWARD -i eth0 -p tcp --dport 5001 -j ACCEPT
> > iptables -A FORWARD -i eth0 -p tcp --dport 5005 -j ACCEPT
> > iptables -A FORWARD -i eth0 -p tcp --dport 5050 -j ACCEPT
> > iptables -A FORWARD -i eth0 -p tcp --dport 6660:6670 -j ACCEPT
> > iptables -A FORWARD -i eth0 -p tcp --dport 7000 -j ACCEPT
> > #iptables -A FORWARD -i eth0 -p tcp --dport 28805 -j ACCEPT
> > iptables -A FORWARD -i eth0 -p tcp --dport 51215 -j ACCEPT
> >
> > iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
>
>Regards,
>
>Antony.
>
>--
>It is also possible that putting the birds in a laboratory setting
>inadvertently renders them relatively incompetent.
>
> - Daniel C Dennet
>
> Please reply to the
>list;
> please don't CC
>me.
>
>
_________________________________________________________________
STOP MORE SPAM with the new MSN 8 and get 2 months FREE*
http://join.msn.com/?page=features/junkmail
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: ftp again
2004-05-22 22:28 ftp again azeem ahmad
@ 2004-05-22 22:50 ` Antony Stone
2004-06-15 14:35 ` Peter Marshall
1 sibling, 0 replies; 7+ messages in thread
From: Antony Stone @ 2004-05-22 22:50 UTC (permalink / raw)
To: netfilter
On Saturday 22 May 2004 11:28 pm, azeem ahmad wrote:
> i issued the commands
> #modprobe ip_nat_ftp
> #modprobe ip_conntrack_ftp
> and now it works well
> but what are these modules and what is the connection tracking. can u tell
> me about any usefull link
http://iptables-tutorial.frozentux.net/iptables-tutorial.html#STATEMACHINE
http://iptables-tutorial.frozentux.net/iptables-tutorial.html#COMPLEXPROTOCOLS
Regards,
Antony.
--
Never write it in Perl if you can do it in Awk.
Never do it in Awk if sed can handle it.
Never use sed when tr can do the job.
Never invoke tr when cat is sufficient.
Avoid using cat whenever possible.
Please reply to the list;
please don't CC me.
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: ftp again
2004-05-22 22:28 ftp again azeem ahmad
2004-05-22 22:50 ` Antony Stone
@ 2004-06-15 14:35 ` Peter Marshall
2004-06-15 14:57 ` Antony Stone
1 sibling, 1 reply; 7+ messages in thread
From: Peter Marshall @ 2004-06-15 14:35 UTC (permalink / raw)
To: azeem ahmad, netfilter
when I try to run the ip_conntrack_ftp module using the command
"modeprobe ip_conntrack_ftp" or
"/sbin/modeprobe ip_conntrack_ftp" it says module not found.
I searched for the module on my system and it does exist in
"/lib/modules/2.4.20-8/kernel/net/ipv4/netfilter/"
Any suggestions ?
I am running rh9
Peter
----- Original Message -----
From: "azeem ahmad" <azeem484@hotmail.com>
To: <netfilter@lists.netfilter.org>
Sent: Saturday, May 22, 2004 7:28 PM
Subject: Re: ftp again
i issued the commands
#modprobe ip_nat_ftp
#modprobe ip_conntrack_ftp
and now it works well
but what are these modules and what is the connection tracking. can u tell
me about any usefull link
Regards
Azeem
>From: Antony Stone <Antony@Soft-Solutions.co.uk>
>Reply-To: netfilter@lists.netfilter.org
>To: netfilter@lists.netfilter.org
>Subject: Re: ftp again
>Date: Sat, 22 May 2004 16:56:16 +0100
>
>On Saturday 22 May 2004 4:29 pm, azeem ahmad wrote:
>
> > hi all
> > when i run this script on my box the natting of ftp stops. neither
>clients
> > browse in non-paasive mode nor in passive mode
> > what is the problem
>
>Perhaps you do not have the nat_ftp and conntrack_ftp modules loaded or
>compiled into your kernel?
>
> > iptables -F
> > iptables -t nat -F
> > iptables -P INPUT DROP
> > iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
> > iptables -A INPUT -i eth0 -p tcp --dport 8080 -j ACCEPT
> > iptables -A INPUT -i eth0 -p udp --dport 8080 -j ACCEPT
>
>What are you using UDP port 8080 for?
>
> > iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT
> > iptables -A INPUT -i eth0 -p tcp --dport 53 -j ACCEPT
> > iptables -A INPUT -i eth0 -p udp --dport 53 -j ACCEPT
> > iptables -A INPUT -i eth0 -p udp --dport 137 -j ACCEPT
> > iptables -A INPUT -i eth0 -p udp --dport 138 -j ACCEPT
> > iptables -A INPUT -i eth0 -p tcp --dport 139 -j ACCEPT
> >
> > iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port
>8080
> > iptables -t nat -A PREROUTING -p udp --dport 80 -j REDIRECT --to-port
>8080
>
>Same question as above...
>
> > iptables -P FORWARD DROP
> > iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
> > iptables -A FORWARD -i eth0 -p tcp --dport 20 -j ACCEPT
> > iptables -A FORWARD -i eth0 -p udp --dport 20 -j ACCEPT
> > iptables -A FORWARD -i eth0 -p tcp --dport 21 -j ACCEPT
> > iptables -A FORWARD -i eth0 -p udp --dport 21 -j ACCEPT
>
>FTP does not use UDP, so two of the above four rules are irrelevant, and
>stateful packet filtering (which you are clearly using from the first rule
>in
>your FORWARD chain) means that you do not need a rule for the data
>connection
>on TCP port 20 - therefore you only need one of the above four rules:
>
>iptables -A FORWARD -i eth0 -p tcp --dport 21 -j ACCEPT
>
> > iptables -A FORWARD -i eth0 -p tcp --dport 443 -j ACCEPT
> > iptables -A FORWARD -i eth0 -p tcp --dport 5000 -j ACCEPT
> > iptables -A FORWARD -i eth0 -p tcp --dport 5001 -j ACCEPT
> > iptables -A FORWARD -i eth0 -p tcp --dport 5005 -j ACCEPT
> > iptables -A FORWARD -i eth0 -p tcp --dport 5050 -j ACCEPT
> > iptables -A FORWARD -i eth0 -p tcp --dport 6660:6670 -j ACCEPT
> > iptables -A FORWARD -i eth0 -p tcp --dport 7000 -j ACCEPT
> > #iptables -A FORWARD -i eth0 -p tcp --dport 28805 -j ACCEPT
> > iptables -A FORWARD -i eth0 -p tcp --dport 51215 -j ACCEPT
> >
> > iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
>
>Regards,
>
>Antony.
>
>--
>It is also possible that putting the birds in a laboratory setting
>inadvertently renders them relatively incompetent.
>
> - Daniel C Dennet
>
> Please reply to the
>list;
> please don't CC
>me.
>
>
_________________________________________________________________
STOP MORE SPAM with the new MSN 8 and get 2 months FREE*
http://join.msn.com/?page=features/junkmail
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: ftp again
2004-06-15 14:35 ` Peter Marshall
@ 2004-06-15 14:57 ` Antony Stone
2004-06-15 15:10 ` Peter Marshall
0 siblings, 1 reply; 7+ messages in thread
From: Antony Stone @ 2004-06-15 14:57 UTC (permalink / raw)
To: netfilter
On Tuesday 15 June 2004 3:35 pm, Peter Marshall wrote:
> when I try to run the ip_conntrack_ftp module using the command
> "modeprobe ip_conntrack_ftp" or
> "/sbin/modeprobe ip_conntrack_ftp" it says module not found.
>
> I searched for the module on my system and it does exist in
> "/lib/modules/2.4.20-8/kernel/net/ipv4/netfilter/"
What does "uname -r" tell you for the kernel version you are running?
If this doesn't match 2.4.20-8 then modprobe (note spelling?) will not be able
to find the above file.
Regards,
Antony.
--
There are only 10 types of people in the world:
those who understand binary notation,
and those who don't.
Please reply to the list;
please don't CC me.
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: ftp again
2004-06-15 14:57 ` Antony Stone
@ 2004-06-15 15:10 ` Peter Marshall
0 siblings, 0 replies; 7+ messages in thread
From: Peter Marshall @ 2004-06-15 15:10 UTC (permalink / raw)
To: netfilter
Thanks .. I should have replied to my message about 20 seconds after I
posted ... It is amazing how things will not work when you make a spelling
mistake
ie: modeprobe vis modprobe
Sorry to bother you with a question that involved my stupidity.
Peter
----- Original Message -----
From: "Antony Stone" <Antony@Soft-Solutions.co.uk>
To: <netfilter@lists.netfilter.org>
Sent: Tuesday, June 15, 2004 11:57 AM
Subject: Re: ftp again
On Tuesday 15 June 2004 3:35 pm, Peter Marshall wrote:
> when I try to run the ip_conntrack_ftp module using the command
> "modeprobe ip_conntrack_ftp" or
> "/sbin/modeprobe ip_conntrack_ftp" it says module not found.
>
> I searched for the module on my system and it does exist in
> "/lib/modules/2.4.20-8/kernel/net/ipv4/netfilter/"
What does "uname -r" tell you for the kernel version you are running?
If this doesn't match 2.4.20-8 then modprobe (note spelling?) will not be
able
to find the above file.
Regards,
Antony.
--
There are only 10 types of people in the world:
those who understand binary notation,
and those who don't.
Please reply to the
list;
please don't CC
me.
^ permalink raw reply [flat|nested] 7+ messages in thread
* ftp again
@ 2004-05-22 15:29 azeem ahmad
2004-05-22 15:56 ` Antony Stone
0 siblings, 1 reply; 7+ messages in thread
From: azeem ahmad @ 2004-05-22 15:29 UTC (permalink / raw)
To: netfilter
hi all
when i run this script on my box the natting of ftp stops. neither clients
browse in non-paasive mode nor in passive mode
what is the problem
---------------------------------------------------------------------------------------------------------------------------------------
iptables -F
iptables -t nat -F
iptables -P INPUT DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 8080 -j ACCEPT
iptables -A INPUT -i eth0 -p udp --dport 8080 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 53 -j ACCEPT
iptables -A INPUT -i eth0 -p udp --dport 53 -j ACCEPT
iptables -A INPUT -i eth0 -p udp --dport 137 -j ACCEPT
iptables -A INPUT -i eth0 -p udp --dport 138 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 139 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080
iptables -t nat -A PREROUTING -p udp --dport 80 -j REDIRECT --to-port 8080
iptables -P FORWARD DROP
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i eth0 -p tcp --dport 20 -j ACCEPT
iptables -A FORWARD -i eth0 -p udp --dport 20 -j ACCEPT
iptables -A FORWARD -i eth0 -p tcp --dport 21 -j ACCEPT
iptables -A FORWARD -i eth0 -p udp --dport 21 -j ACCEPT
iptables -A FORWARD -i eth0 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -i eth0 -p tcp --dport 5000 -j ACCEPT
iptables -A FORWARD -i eth0 -p tcp --dport 5001 -j ACCEPT
iptables -A FORWARD -i eth0 -p tcp --dport 5005 -j ACCEPT
iptables -A FORWARD -i eth0 -p tcp --dport 5050 -j ACCEPT
iptables -A FORWARD -i eth0 -p tcp --dport 6660:6670 -j ACCEPT
iptables -A FORWARD -i eth0 -p tcp --dport 7000 -j ACCEPT
#iptables -A FORWARD -i eth0 -p tcp --dport 28805 -j ACCEPT
iptables -A FORWARD -i eth0 -p tcp --dport 51215 -j ACCEPT
iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
------------------------------------------------------------------------------------------------------------------------------------------
Regards
Azeem
_________________________________________________________________
Add photos to your messages with MSN 8. Get 2 months FREE*.
http://join.msn.com/?page=features/featuredemail
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: ftp again
2004-05-22 15:29 azeem ahmad
@ 2004-05-22 15:56 ` Antony Stone
0 siblings, 0 replies; 7+ messages in thread
From: Antony Stone @ 2004-05-22 15:56 UTC (permalink / raw)
To: netfilter
On Saturday 22 May 2004 4:29 pm, azeem ahmad wrote:
> hi all
> when i run this script on my box the natting of ftp stops. neither clients
> browse in non-paasive mode nor in passive mode
> what is the problem
Perhaps you do not have the nat_ftp and conntrack_ftp modules loaded or
compiled into your kernel?
> iptables -F
> iptables -t nat -F
> iptables -P INPUT DROP
> iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
> iptables -A INPUT -i eth0 -p tcp --dport 8080 -j ACCEPT
> iptables -A INPUT -i eth0 -p udp --dport 8080 -j ACCEPT
What are you using UDP port 8080 for?
> iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT
> iptables -A INPUT -i eth0 -p tcp --dport 53 -j ACCEPT
> iptables -A INPUT -i eth0 -p udp --dport 53 -j ACCEPT
> iptables -A INPUT -i eth0 -p udp --dport 137 -j ACCEPT
> iptables -A INPUT -i eth0 -p udp --dport 138 -j ACCEPT
> iptables -A INPUT -i eth0 -p tcp --dport 139 -j ACCEPT
>
> iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080
> iptables -t nat -A PREROUTING -p udp --dport 80 -j REDIRECT --to-port 8080
Same question as above...
> iptables -P FORWARD DROP
> iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
> iptables -A FORWARD -i eth0 -p tcp --dport 20 -j ACCEPT
> iptables -A FORWARD -i eth0 -p udp --dport 20 -j ACCEPT
> iptables -A FORWARD -i eth0 -p tcp --dport 21 -j ACCEPT
> iptables -A FORWARD -i eth0 -p udp --dport 21 -j ACCEPT
FTP does not use UDP, so two of the above four rules are irrelevant, and
stateful packet filtering (which you are clearly using from the first rule in
your FORWARD chain) means that you do not need a rule for the data connection
on TCP port 20 - therefore you only need one of the above four rules:
iptables -A FORWARD -i eth0 -p tcp --dport 21 -j ACCEPT
> iptables -A FORWARD -i eth0 -p tcp --dport 443 -j ACCEPT
> iptables -A FORWARD -i eth0 -p tcp --dport 5000 -j ACCEPT
> iptables -A FORWARD -i eth0 -p tcp --dport 5001 -j ACCEPT
> iptables -A FORWARD -i eth0 -p tcp --dport 5005 -j ACCEPT
> iptables -A FORWARD -i eth0 -p tcp --dport 5050 -j ACCEPT
> iptables -A FORWARD -i eth0 -p tcp --dport 6660:6670 -j ACCEPT
> iptables -A FORWARD -i eth0 -p tcp --dport 7000 -j ACCEPT
> #iptables -A FORWARD -i eth0 -p tcp --dport 28805 -j ACCEPT
> iptables -A FORWARD -i eth0 -p tcp --dport 51215 -j ACCEPT
>
> iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
Regards,
Antony.
--
It is also possible that putting the birds in a laboratory setting
inadvertently renders them relatively incompetent.
- Daniel C Dennet
Please reply to the list;
please don't CC me.
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2004-06-15 15:10 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2004-05-22 22:28 ftp again azeem ahmad
2004-05-22 22:50 ` Antony Stone
2004-06-15 14:35 ` Peter Marshall
2004-06-15 14:57 ` Antony Stone
2004-06-15 15:10 ` Peter Marshall
-- strict thread matches above, loose matches on Subject: below --
2004-05-22 15:29 azeem ahmad
2004-05-22 15:56 ` Antony Stone
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox