From mboxrd@z Thu Jan 1 00:00:00 1970 From: "wickedsun" Subject: Re: ftp server issue, trying to DL 1.2.7a Date: Sat, 7 Sep 2002 11:33:36 -0400 (Eastern Daylight Time) Sender: netfilter-admin@lists.netfilter.org Message-ID: <3D7A1C50.000001.00620@athlon1000> References: <3D79FC89.9070001@fugmann.dhs.org> Mime-Version: 1.0 Content-Type: Multipart/Alternative; boundary="------------Boundary-00=_08R2QL80000000000000" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: afu@fugmann.dhs.org Cc: netfilter@lists.netfilter.org --------------Boundary-00=_08R2QL80000000000000 Content-Type: Text/Plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Ahh yes, that makes sense. It's behaving like the old ip_masq_ftp module. Thanks for the info, again ;)=0D =0D Charles=0D =0D -------Original Message-------=0D =0D From: Anders Fugmann=0D Date: Saturday, September 07, 2002 10:27:31 AM=0D To: wickedsun=0D Cc: netfilter@lists.netfilter.org=0D Subject: Re: ftp server issue, trying to DL 1.2.7a=0D =0D wickedsun wrote:=0D > FTP Issues, round 2.=0D > =0D > =0D > With further testing, I've noticed that it doesnt quite work. For some = =0D > unknown reason, it *seems* to work on port 21, but doesnt on other =0D Seems or does?=0D =0D > ports. From what I understood in your post, you said it would work on =0D > any port. (FTP, of course).=0D =0D > =0D No. The ftp connection tracking module only monitors on port 21. Because = =0D it has to examine all packets beeing send though, it would simple be too = =0D much work to monitor any connection made. If you want it to monitor =0D other ports also, you can compile the ftp connection tracking as a =0D module, and then use:=0D modprobe ip_conntrack_ftp 21,5006=0D to let it listen on ports 21 and 5006.=0D =0D I do not know if there is any way to make this work with =0D ftp_connection_tracking statically compiled in the kernel.=0D =0D Regards=0D Anders Fugmann=0D =0D -- =0D Author of FIAIF=0D FIAIF Is An Intelligent Firewall=0D http://fiaif.fugmann.dhs.org=0D =0D =0D =0D =2E=20 --------------Boundary-00=_08R2QL80000000000000 Content-Type: Text/HTML; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Ahh yes, that makes sense. It's behaving like the old ip_m= asq_ftp module. Thanks for the info, again ;)

Charles

-------Original Message-------

From: Anders Fugmann

Date: Saturday, Se= ptember 07, 2002 10:27:31 AM

To: wickedsun

Cc: netfilter@lists.netfilter.org

Subject: Re: ftp s= erver issue, trying to DL 1.2.7a

wickedsun wrote:
> FTP Issues, round 2.
> >
> With further testing, I've noticed that it doesnt quite w= ork. For some
> unknown reason, it *seems* to work on port 21, but= doesnt on other
Seems or does?

> ports. From what I unders= tood in your post, you said it would work on
> any port. (FTP, of = course).

>
No. The ftp connection tracking module only moni= tors on port 21. Because
it has to examine all packets beeing send th= ough, it would simple be too
much work to monitor any connection made= =2E If you want it to monitor
other ports also, you can compile the f= tp connection tracking as a
module, and then use:
modprobe ip_conn= track_ftp 21,5006
to let it listen on ports 21 and 5006.

I do n= ot know if there is any way to make this work with
ftp_connection_tra= cking statically compiled in the kernel.

Regards
Anders Fugmann=

--
Author of FIAIF
FIAIF Is An Intelligent Firewall
http://fiaif.fugmann.dhs.org

.

--------------Boundary-00=_08R2QL80000000000000--