Re: ftp again

[Antony Stone <Antony@Soft-Solutions.co.uk>]

On Saturday 22 May 2004 4:29 pm, azeem ahmad wrote:

> hi all
> when i run this script on my box the natting of ftp stops. neither clients
> browse in non-paasive mode nor in passive mode
> what is the problem

Perhaps you do not have the nat_ftp and conntrack_ftp modules loaded or 
compiled into your kernel?

> iptables -F
> iptables -t nat -F
> iptables -P INPUT DROP
> iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
> iptables -A INPUT -i eth0 -p tcp --dport 8080 -j ACCEPT
> iptables -A INPUT -i eth0 -p udp --dport 8080 -j ACCEPT

What are you using UDP port 8080 for?

> iptables -A INPUT -i eth0 -p tcp --dport 22   -j ACCEPT
> iptables -A INPUT -i eth0 -p tcp --dport 53   -j ACCEPT
> iptables -A INPUT -i eth0 -p udp --dport 53   -j ACCEPT
> iptables -A INPUT -i eth0 -p udp --dport 137  -j ACCEPT
> iptables -A INPUT -i eth0 -p udp --dport 138  -j ACCEPT
> iptables -A INPUT -i eth0 -p tcp --dport 139  -j ACCEPT
>
> iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080
> iptables -t nat -A PREROUTING -p udp --dport 80 -j REDIRECT --to-port 8080

Same question as above...

> iptables -P FORWARD DROP
> iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
> iptables -A FORWARD -i eth0 -p tcp --dport 20        -j ACCEPT
> iptables -A FORWARD -i eth0 -p udp --dport 20        -j ACCEPT
> iptables -A FORWARD -i eth0 -p tcp --dport 21        -j ACCEPT
> iptables -A FORWARD -i eth0 -p udp --dport 21        -j ACCEPT

FTP does not use UDP, so two of the above four rules are irrelevant, and 
stateful packet filtering (which you are clearly using from the first rule in 
your FORWARD chain) means that you do not need a rule for the data connection 
on TCP port 20 - therefore you only need one of the above four rules:

iptables -A FORWARD -i eth0 -p tcp --dport 21        -j ACCEPT

> iptables -A FORWARD -i eth0 -p tcp --dport 443       -j ACCEPT
> iptables -A FORWARD -i eth0 -p tcp --dport 5000      -j ACCEPT
> iptables -A FORWARD -i eth0 -p tcp --dport 5001      -j ACCEPT
> iptables -A FORWARD -i eth0 -p tcp --dport 5005      -j ACCEPT
> iptables -A FORWARD -i eth0 -p tcp --dport 5050      -j ACCEPT
> iptables -A FORWARD -i eth0 -p tcp --dport 6660:6670 -j ACCEPT
> iptables -A FORWARD -i eth0 -p tcp --dport 7000      -j ACCEPT
> #iptables -A FORWARD -i eth0 -p tcp --dport 28805     -j ACCEPT
> iptables -A FORWARD -i eth0 -p tcp --dport 51215     -j ACCEPT
>
> iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE

Regards,

Antony.

-- 
It is also possible that putting the birds in a laboratory setting 
inadvertently renders them relatively incompetent.

 - Daniel C Dennet

                                                     Please reply to the list;
                                                           please don't CC me.