Linux Netfilter discussions
 help / color / mirror / Atom feed
* Is iptables kickin' that much?
@ 2002-09-06 13:40 wickedsun
  2002-09-06 23:44 ` Anders Fugmann
  0 siblings, 1 reply; 5+ messages in thread
From: wickedsun @ 2002-09-06 13:40 UTC (permalink / raw)
  To: netfilter

I'm not sure I understood very well what you explained. But I have only one
thing to say, it works. Now the question is, will this work with any
protocol? (ftp, irc, etc). The thing is scary me a bit. I read in your email
that you have to load up a FTP module (which I have compiled in the kernel)
and it seems to me that it works with other protocol as well. (I was able to
enable Active in DC++ without having to forward manually each ports like I
used to do).

This was of a huge help for the iptables newbies (including me) and thanks.



Charles

-----------------------
Original Message:
 As alot of others replies the problem is when ftp enters passive mode,
the server initiates a dataconnection to your machine.

Fortunatly, is a "port" command is send first over the command channel,
in order to let the client and server know how and where this new 
connection will be established.

This can be caught by the netfilter code, and netfilter can allow this 
connection to be accepted from the server in a quite clever way, because 
netfilter is _statefull_. ipchans was not, and hence this was not possible.

The following gives an example of how netfilter can handle this:
Lets assume that you are sittin behind a iptables firewall doing nat,
and all you want is to allow users from the inside (eth0) to conenct to 
the internet through the external link (ppp0)

# First load the heper modules for the ftp protocol connection tracking.
# Delete these lines, if the modules are compiled statically into the
# kernel.
modprobe ip_conntrack_ftp
# And the nat part for the ftp protocol.
modprobe ip_nat_ftp

# Set default policies.
iptables -P INPUT drop
iptables -P FORWARD drop
iptables -P OUTPUT accept

# NAT all connections
iptables -t nat -A POSTROUTING -o ppp0 -j MASQUEADE

# Allow the mashine to make any kind of connections.
iptables -A INPUT -m state --state ESTABLISHED,RELATED \
-j ACCEPT

# Allow the same for machines located behind the firewall.
iptables -A FORWARD -i eth0 -o ppp0 -j ACCEPT
iptables -A FORWARD -o eth0 -i ppp0 -m state \
--state ESTABLISHED,RELATED -j ACCEPT


And we are all done. The trick is to use the 'state' match. The RELATED
state will match the first packet in the data-connection from the 
ftp-server in passive mode. Any packets hereafter will be in the 
ESTABLISHED state.

As you might have noticed, there is no protocol speicifer. So this also 
works for e.g. DNS lookups (udp) and ICMP packets related to an already 
esablished connection. Statefull firewalling is just sooo great.

There is no reason for you to patch the kernel in order to do this,
this has been possible for a long time.

Regards
Anders Fugmann

 
 
 
-----------------
Charles D'Aoust
wickedsun@phreaker.net
wicked@unraved.org


^ permalink raw reply	[flat|nested] 5+ messages in thread
end of thread, other threads:[~2002-09-07 12:46 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2002-09-06 13:40 Is iptables kickin' that much? wickedsun
2002-09-06 23:44 ` Anders Fugmann
2002-09-07  2:12   ` wickedsun
2002-09-07  9:11     ` Anders Fugmann
2002-09-07 12:46   ` Mike D

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox