From mboxrd@z Thu Jan 1 00:00:00 1970 From: "wickedsun" Subject: Re: ftp server issue, trying to DL 1.2.7a Date: Sat, 7 Sep 2002 08:38:08 -0400 (Eastern Daylight Time) Sender: netfilter-admin@lists.netfilter.org Message-ID: <3D79F330.000001.00620@athlon1000> References: <3D7877D3.6040608@fugmann.dhs.org> Mime-Version: 1.0 Content-Type: Multipart/Alternative; boundary="------------Boundary-00=_K3J2QL80000000000000" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: afu@fugmann.dhs.org, rwideman@austin.rr.com Cc: netfilter@lists.netfilter.org --------------Boundary-00=_K3J2QL80000000000000 Content-Type: Text/Plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable FTP Issues, round 2.=0D =0D =0D With further testing, I've noticed that it doesnt quite work. For some unknown reason, it *seems* to work on port 21, but doesnt on other ports. =46rom what I understood in your post, you said it would work on any port= =2E (FTP, of course).=0D =0D 9/7/2002 8:31:12 AM PORT 192,168,0,1,4,131=0D 9/7/2002 8:31:12 AM 200-FXP transfer: from 208.58.49.10 to 192.168.0.1=0D 9/7/2002 8:31:12 AM 200 PORT command successful=0D 9/7/2002 8:31:12 AM LIST=0D 9/7/2002 8:31:13 AM 425 Could not open data connection to port 1155: No route to host=0D =0D The address does not get filtered (that FTP has automatic FXP detection..= if the IP in the PORT command differs from the IP of the person that connect= ed to the FTP, it assumes its a FXP transfer.)=0D =0D That was on port 8989.=0D =0D On the other hand, port 21 is fine:=0D =0D 9/7/2002 8:35:11 AM PORT 192,168,0,1,4,137=0D 9/7/2002 8:35:11 AM 200 PORT command successful.=0D 9/7/2002 8:35:11 AM LIST=0D 9/7/2002 8:35:11 AM Data Connection opened.=0D 9/7/2002 8:35:11 AM 150 Opening ASCII mode data connection for file list.= =0D 9/7/2002 8:35:11 AM 226-Transfer complete.=0D 9/7/2002 8:35:11 AM 370 bytes transferred in 00:00:00, 370 bytes/sec=0D =0D =0D Any ideas?=0D =0D =0D Charles=0D =0D =0D -------Original Message-------=0D =0D From: Anders Fugmann=0D Date: Friday, September 06, 2002 6:30:59 AM=0D To: Rob=0D Cc: netfilter@lists.netfilter.org=0D Subject: Re: ftp server issue, trying to DL 1.2.7a=0D =0D Rob wrote:=0D > ftp> dir=0D > 227 Entering Passive Mode (62,128,28,62,182,53).=0D > =0D As alot of others replies the problem is when ftp enters passive mode,=0D the server initiates a dataconnection to your machine.=0D =0D Fortunatly, is a "port" command is send first over the command channel,=0D in order to let the client and server know how and where this new =0D connection will be established.=0D =0D This can be caught by the netfilter code, and netfilter can allow this =0D connection to be accepted from the server in a quite clever way, because = =0D netfilter is _statefull_. ipchans was not, and hence this was not possibl= e.=0D =0D The following gives an example of how netfilter can handle this:=0D Lets assume that you are sittin behind a iptables firewall doing nat,=0D and all you want is to allow users from the inside (eth0) to conenct to =0D the internet through the external link (ppp0)=0D =0D # First load the heper modules for the ftp protocol connection tracking.=0D # Delete these lines, if the modules are compiled statically into the=0D # kernel.=0D modprobe ip_conntrack_ftp=0D # And the nat part for the ftp protocol.=0D modprobe ip_nat_ftp=0D =0D # Set default policies.=0D iptables -P INPUT drop=0D iptables -P FORWARD drop=0D iptables -P OUTPUT accept=0D =0D # NAT all connections=0D iptables -t nat -A POSTROUTING -o ppp0 -j MASQUEADE=0D =0D # Allow the mashine to make any kind of connections.=0D iptables -A INPUT -m state --state ESTABLISHED,RELATED \=0D -j ACCEPT=0D =0D # Allow the same for machines located behind the firewall.=0D iptables -A FORWARD -i eth0 -o ppp0 -j ACCEPT=0D iptables -A FORWARD -o eth0 -i ppp0 -m state \=0D --state ESTABLISHED,RELATED -j ACCEPT=0D =0D =0D And we are all done. The trick is to use the 'state' match. The RELATED=0D state will match the first packet in the data-connection from the =0D ftp-server in passive mode. Any packets hereafter will be in the =0D ESTABLISHED state.=0D =0D As you might have noticed, there is no protocol speicifer. So this also =0D works for e.g. DNS lookups (udp) and ICMP packets related to an already =0D esablished connection. Statefull firewalling is just sooo great.=0D =0D There is no reason for you to patch the kernel in order to do this,=0D this has been possible for a long time.=0D =0D Regards=0D Anders Fugmann=0D =0D -- =0D Author of FIAIF=0D FIAIF Is An Intelligent Firewall=0D http://fiaif.fugmann.dhs.org=0D =0D =0D =0D =2E=20 --------------Boundary-00=_K3J2QL80000000000000 Content-Type: Text/HTML; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
FTP Issues, round 2.
 
 
With further testing, I've noticed that it doesnt quite work. For so= me unknown reason, it *seems* to work on port 21, but doesnt on othe= r ports. From what I understood in your post, you said it would work= on any port. (FTP, of course).
 
9/7/2002 8:31:12 AM PORT 192,168,0,1,4,131
9/7/2002 8:31:12 AM 20= 0-FXP transfer: from 208.58.49.10 to 192.168.0.1
9/7/2002 8:31:12 AM 2= 00 PORT command successful
9/7/2002 8:31:12 AM LIST
9/7/2002 8:31:1= 3 AM 425 Could not open data connection to port 1155: No route to host
The address does not get filtered (that FTP has automatic FXP detect= ion.. if the IP in the PORT command differs from the IP of the person tha= t connected to the FTP, it assumes its a FXP transfer.)
 
That was on port 8989.
 
On the other hand, port 21 is fine:
 
9/7/2002 8:35:11 AM PORT 192,168,0,1,4,137
9/7/2002 8:35:11 AM 20= 0 PORT command successful.
9/7/2002 8:35:11 AM LIST
9/7/2002 8:35:1= 1 AM Data Connection opened.
9/7/2002 8:35:11 AM 150 Opening ASCII mod= e data connection for file list.
9/7/2002 8:35:11 AM 226-Transfer comp= lete.
9/7/2002 8:35:11 AM 370 bytes transferred in 00:00:00, 370 bytes= /sec
 
Any ideas?
 
 
Charles
 
 
-------Original Message-------
 
Date: Friday, Sept= ember 06, 2002 6:30:59 AM
To: Rob
Cc: netfilter@lists.netfilter.org
Subject: Re: ftp s= erver issue, trying to DL 1.2.7a
 
Rob wrote:
> ftp> dir
> 227 Entering Pass= ive Mode (62,128,28,62,182,53).
>
As alot of others replies the= problem is when ftp enters passive mode,
the server initiates a datac= onnection to your machine.

Fortunatly, is a "port" command is send= first over the command channel,
in order to let the client and server= know how and where this new
connection will be established.

T= his can be caught by the netfilter code, and netfilter can allow this connection to be accepted from the server in a quite clever way, because=
netfilter is _statefull_. ipchans was not, and hence this was not po= ssible.

The following gives an example of how netfilter can handle= this:
Lets assume that you are sittin behind a iptables firewall doin= g nat,
and all you want is to allow users from the inside (eth0) to co= nenct to
the internet through the external link (ppp0)

# First= load the heper modules for the ftp protocol connection tracking.
# De= lete these lines, if the modules are compiled statically into the
# ke= rnel.
modprobe ip_conntrack_ftp
# And the nat part for the ftp prot= ocol.
modprobe ip_nat_ftp

# Set default policies.
iptables -= P INPUT drop
iptables -P FORWARD drop
iptables -P OUTPUT accept
=
# NAT all connections
iptables -t nat -A POSTROUTING -o ppp0 -j MA= SQUEADE

# Allow the mashine to make any kind of connections.
ip= tables -A INPUT -m state --state ESTABLISHED,RELATED \
-j ACCEPT
# Allow the same for machines located behind the firewall.
iptables = -A FORWARD -i eth0 -o ppp0 -j ACCEPT
iptables -A FORWARD -o eth0 -i pp= p0 -m state \
--state ESTABLISHED,RELATED -j ACCEPT


And we = are all done. The trick is to use the 'state' match. The RELATED
state= will match the first packet in the data-connection from the
ftp-serv= er in passive mode. Any packets hereafter will be in the
ESTABLISHED = state.

As you might have noticed, there is no protocol speicifer. = So this also
works for e.g. DNS lookups (udp) and ICMP packets relate= d to an already
esablished connection. Statefull firewalling is just = sooo great.

There is no reason for you to patch the kernel in orde= r to do this,
this has been possible for a long time.

RegardsAnders Fugmann

--
Author of FIAIF
FIAIF Is An Intelligent= Firewall
http://fiaif.fugman= n.dhs.org



.
--------------Boundary-00=_K3J2QL80000000000000--