nftables and FTP connection tracking

nftables and FTP connection tracking

[tomekx1000]

Dear All,

Could you have a look at my simple nft firewall script below, I've used 
ct related, established, but it doesnt work with passive mode FTP - the 
data session on high ports is dropped by firewall. Does NFTables have 
connection tracking helper for FTP? If not - is it planned in foreseable 
future to add it?

table ip filter {
  chain input {
  type filter hook input priority 0;
  dport {21} ct state new limit rate 2/second counter accept
  ct state {established, related} counter accept
  counter limit rate 100/second log group 2 prefix "RULE=Default drop"
  counter drop
  }

  chain output {
  type filter hook output priority 0;
  ct state {established, related} counter accept
  }

}

Re: nftables and FTP connection tracking

[Pablo Neira Ayuso]

On Thu, Aug 14, 2014 at 11:29:57AM +0200, tomekx1000 wrote:
> Dear All,
> 
> Could you have a look at my simple nft firewall script below, I've
> used ct related, established, but it doesnt work with passive mode
> FTP - the data session on high ports is dropped by firewall. Does
> NFTables have connection tracking helper for FTP?

Yes, no changes in that regard.

> If not - is it planned in foreseable future to add it?
> 
> table ip filter {
>  chain input {
>  type filter hook input priority 0;
>  dport {21} ct state new limit rate 2/second counter accept

The brackets have special meaning. If you uses brackets to wrap
elements, the kernel will create a set for it with one single element.
Better use the brackets when you have multiple elements. In this case,
I suggest you to use:

   tcp dport 21 ...

>  ct state {established, related} counter accept
            ^                    ^

No need to use the brackets here:

   ct state established,related ...

The ct state allows enumeration of several states using commas. This
is due to the fact that ct state internally represents the states as a
bitmask.

You can check that use the describe command:

# nft describe ct state
ct expression, datatype ct_state (conntrack state) (basetype bitmask,
integer), 32 bits

pre-defined symbolic constants:
        invalid                         0x00000001
        new                             0x00000008
        established                     0x00000002
        related                         0x00000004
        untracked                       0x00000040

Basically, all bitmask types can use the comma-separated enumeration
notation to combine the supported flags.

You can use describe to inquire for other selectors in case of doubt.

Re: nftables and FTP connection tracking

[tomekx1000]

Thank you Pablo for clarification on usage of brackets. I've updated 
script, however still no joy when connecting to server FTP. Maybe i'm 
missing some modules?

# lsmod | grep conn
nf_conntrack_ftp 7059 1 nf_nat_ftp
nf_conntrack_ipv4 8066 19
nf_defrag_ipv4 1235 1 nf_conntrack_ipv4
nf_conntrack 55929 5 
nf_nat_ftp,nf_nat,nft_ct,nf_conntrack_ftp,nf_conntrack_ipv4

Here is the corrected script:
table filter {

    chain input {
       type filter hook input priority 0;
       tcp dport 21 ct state new counter accept
       ct state related counter accept
       ct state established counter accept
       counter limit rate 100/second log group 2 prefix "RULE=Default 
drop"
       counter drop
    }

   chain output {
       type filter hook output priority 0;
        ct state established, related counter accept
    }

}

After connecting to port 21, FTP servers tries to negotiate data 
connection on high ports, and this new connection is dropped...
How can I make FTP helper to work with nftables?


W dniu 20:02 14-08-14, Pablo Neira Ayuso napisał(a):

> On Thu, Aug 14, 2014 at 11:29:57AM +0200, tomekx1000 wrote:
> 
>> Dear All, Could you have a look at my simple nft firewall script 
>> below, I've used ct related, established, but it doesnt work with 
>> passive mode FTP - the data session on high ports is dropped by 
>> firewall. Does NFTables have connection tracking helper for FTP?
> 
> Yes, no changes in that regard.
> 
>> If not - is it planned in foreseable future to add it? table ip filter 
>> { chain input { type filter hook input priority 0; dport {21} ct state 
>> new limit rate 2/second counter accept
> 
> The brackets have special meaning. If you uses brackets to wrap
> elements, the kernel will create a set for it with one single element.
> Better use the brackets when you have multiple elements. In this case,
> I suggest you to use:
> 
> tcp dport 21 ...
> 
>> ct state {established, related} counter accept
> 
> ^ ^
> 
> No need to use the brackets here:
> 
> ct state established,related ...
> 
> The ct state allows enumeration of several states using commas. This
> is due to the fact that ct state internally represents the states as a
> bitmask.
> 
> You can check that use the describe command:
> 
> # nft describe ct state
> ct expression, datatype ct_state (conntrack state) (basetype bitmask,
> integer), 32 bits
> 
> pre-defined symbolic constants:
> invalid 0x00000001
> new 0x00000008
> established 0x00000002
> related 0x00000004
> untracked 0x00000040
> 
> Basically, all bitmask types can use the comma-separated enumeration
> notation to combine the supported flags.
> 
> You can use describe to inquire for other selectors in case of doubt.

nftables and FTP connection tracking

[Tomek L]

Hi All,

Could you have a look at my simple nft firewall script below, I've
used ct related, established, but it doesnt work with passive mode FTP
- the data session on high ports is dropped by firewall. Does NFTables
have connection tracking helper for FTP? If not - is it planned in
foreseable future to add it?

table ip filter {
        chain input {
                 type filter hook input priority 0;
                 dport {21} ct state new limit rate 2/second counter accept
                 ct state {established, related} counter accept
                 counter limit rate 100/second log group 2 prefix
"RULE=Default drop"
                 counter drop
        }

        chain output {
                 type filter hook output priority 0;
                 ct state {established, related} counter accept
        }

}

nftables and FTP connection tracking

[Tomek L]

Hi All,

Could you have a look at my simple nft firewall script below, I've
used ct related, established, but it doesnt work with passive mode FTP
- the data session on high ports is dropped by firewall. Does NFTables
have connection tracking helper for FTP? If not - is it planned in
foreseable future to add it?

table ip filter {
        chain input {
                 type filter hook input priority 0;
                 dport {21} ct state new limit rate 2/second counter accept
                 ct state {established, related} counter accept
                 counter limit rate 100/second log group 2 prefix
"RULE=Default drop"
                 counter drop
        }

        chain output {
                 type filter hook output priority 0;
                 ct state {established, related} counter accept
        }

}