Linux Netfilter discussions
 help / color / mirror / Atom feed
* ftp again
@ 2004-05-22 15:29 azeem ahmad
  2004-05-22 15:56 ` Antony Stone
  0 siblings, 1 reply; 7+ messages in thread
From: azeem ahmad @ 2004-05-22 15:29 UTC (permalink / raw)
  To: netfilter

hi all
when i run this script on my box the natting of ftp stops. neither clients 
browse in non-paasive mode nor in passive mode
what is the problem

---------------------------------------------------------------------------------------------------------------------------------------
iptables -F
iptables -t nat -F
iptables -P INPUT DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 8080 -j ACCEPT
iptables -A INPUT -i eth0 -p udp --dport 8080 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 22   -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 53   -j ACCEPT
iptables -A INPUT -i eth0 -p udp --dport 53   -j ACCEPT
iptables -A INPUT -i eth0 -p udp --dport 137  -j ACCEPT
iptables -A INPUT -i eth0 -p udp --dport 138  -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 139  -j ACCEPT

iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080
iptables -t nat -A PREROUTING -p udp --dport 80 -j REDIRECT --to-port 8080

iptables -P FORWARD DROP
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i eth0 -p tcp --dport 20        -j ACCEPT
iptables -A FORWARD -i eth0 -p udp --dport 20        -j ACCEPT
iptables -A FORWARD -i eth0 -p tcp --dport 21        -j ACCEPT
iptables -A FORWARD -i eth0 -p udp --dport 21        -j ACCEPT
iptables -A FORWARD -i eth0 -p tcp --dport 443       -j ACCEPT
iptables -A FORWARD -i eth0 -p tcp --dport 5000      -j ACCEPT
iptables -A FORWARD -i eth0 -p tcp --dport 5001      -j ACCEPT
iptables -A FORWARD -i eth0 -p tcp --dport 5005      -j ACCEPT
iptables -A FORWARD -i eth0 -p tcp --dport 5050      -j ACCEPT
iptables -A FORWARD -i eth0 -p tcp --dport 6660:6670 -j ACCEPT
iptables -A FORWARD -i eth0 -p tcp --dport 7000      -j ACCEPT
#iptables -A FORWARD -i eth0 -p tcp --dport 28805     -j ACCEPT
iptables -A FORWARD -i eth0 -p tcp --dport 51215     -j ACCEPT

iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
------------------------------------------------------------------------------------------------------------------------------------------

Regards
Azeem

_________________________________________________________________
Add photos to your messages with MSN 8. Get 2 months FREE*. 
http://join.msn.com/?page=features/featuredemail



^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: ftp again
  2004-05-22 15:29 azeem ahmad
@ 2004-05-22 15:56 ` Antony Stone
  0 siblings, 0 replies; 7+ messages in thread
From: Antony Stone @ 2004-05-22 15:56 UTC (permalink / raw)
  To: netfilter

On Saturday 22 May 2004 4:29 pm, azeem ahmad wrote:

> hi all
> when i run this script on my box the natting of ftp stops. neither clients
> browse in non-paasive mode nor in passive mode
> what is the problem

Perhaps you do not have the nat_ftp and conntrack_ftp modules loaded or 
compiled into your kernel?

> iptables -F
> iptables -t nat -F
> iptables -P INPUT DROP
> iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
> iptables -A INPUT -i eth0 -p tcp --dport 8080 -j ACCEPT
> iptables -A INPUT -i eth0 -p udp --dport 8080 -j ACCEPT

What are you using UDP port 8080 for?

> iptables -A INPUT -i eth0 -p tcp --dport 22   -j ACCEPT
> iptables -A INPUT -i eth0 -p tcp --dport 53   -j ACCEPT
> iptables -A INPUT -i eth0 -p udp --dport 53   -j ACCEPT
> iptables -A INPUT -i eth0 -p udp --dport 137  -j ACCEPT
> iptables -A INPUT -i eth0 -p udp --dport 138  -j ACCEPT
> iptables -A INPUT -i eth0 -p tcp --dport 139  -j ACCEPT
>
> iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080
> iptables -t nat -A PREROUTING -p udp --dport 80 -j REDIRECT --to-port 8080

Same question as above...

> iptables -P FORWARD DROP
> iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
> iptables -A FORWARD -i eth0 -p tcp --dport 20        -j ACCEPT
> iptables -A FORWARD -i eth0 -p udp --dport 20        -j ACCEPT
> iptables -A FORWARD -i eth0 -p tcp --dport 21        -j ACCEPT
> iptables -A FORWARD -i eth0 -p udp --dport 21        -j ACCEPT

FTP does not use UDP, so two of the above four rules are irrelevant, and 
stateful packet filtering (which you are clearly using from the first rule in 
your FORWARD chain) means that you do not need a rule for the data connection 
on TCP port 20 - therefore you only need one of the above four rules:

iptables -A FORWARD -i eth0 -p tcp --dport 21        -j ACCEPT

> iptables -A FORWARD -i eth0 -p tcp --dport 443       -j ACCEPT
> iptables -A FORWARD -i eth0 -p tcp --dport 5000      -j ACCEPT
> iptables -A FORWARD -i eth0 -p tcp --dport 5001      -j ACCEPT
> iptables -A FORWARD -i eth0 -p tcp --dport 5005      -j ACCEPT
> iptables -A FORWARD -i eth0 -p tcp --dport 5050      -j ACCEPT
> iptables -A FORWARD -i eth0 -p tcp --dport 6660:6670 -j ACCEPT
> iptables -A FORWARD -i eth0 -p tcp --dport 7000      -j ACCEPT
> #iptables -A FORWARD -i eth0 -p tcp --dport 28805     -j ACCEPT
> iptables -A FORWARD -i eth0 -p tcp --dport 51215     -j ACCEPT
>
> iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE

Regards,

Antony.

-- 
It is also possible that putting the birds in a laboratory setting 
inadvertently renders them relatively incompetent.

 - Daniel C Dennet

                                                     Please reply to the list;
                                                           please don't CC me.



^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: ftp again
@ 2004-05-22 22:28 azeem ahmad
  2004-05-22 22:50 ` Antony Stone
  2004-06-15 14:35 ` Peter Marshall
  0 siblings, 2 replies; 7+ messages in thread
From: azeem ahmad @ 2004-05-22 22:28 UTC (permalink / raw)
  To: netfilter

i issued the commands
#modprobe ip_nat_ftp
#modprobe ip_conntrack_ftp
and now it works well
but what are these modules and what is the connection tracking. can u tell 
me about any usefull link

Regards
Azeem


>From: Antony Stone <Antony@Soft-Solutions.co.uk>
>Reply-To: netfilter@lists.netfilter.org
>To: netfilter@lists.netfilter.org
>Subject: Re: ftp again
>Date: Sat, 22 May 2004 16:56:16 +0100
>
>On Saturday 22 May 2004 4:29 pm, azeem ahmad wrote:
>
> > hi all
> > when i run this script on my box the natting of ftp stops. neither 
>clients
> > browse in non-paasive mode nor in passive mode
> > what is the problem
>
>Perhaps you do not have the nat_ftp and conntrack_ftp modules loaded or
>compiled into your kernel?
>
> > iptables -F
> > iptables -t nat -F
> > iptables -P INPUT DROP
> > iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
> > iptables -A INPUT -i eth0 -p tcp --dport 8080 -j ACCEPT
> > iptables -A INPUT -i eth0 -p udp --dport 8080 -j ACCEPT
>
>What are you using UDP port 8080 for?
>
> > iptables -A INPUT -i eth0 -p tcp --dport 22   -j ACCEPT
> > iptables -A INPUT -i eth0 -p tcp --dport 53   -j ACCEPT
> > iptables -A INPUT -i eth0 -p udp --dport 53   -j ACCEPT
> > iptables -A INPUT -i eth0 -p udp --dport 137  -j ACCEPT
> > iptables -A INPUT -i eth0 -p udp --dport 138  -j ACCEPT
> > iptables -A INPUT -i eth0 -p tcp --dport 139  -j ACCEPT
> >
> > iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 
>8080
> > iptables -t nat -A PREROUTING -p udp --dport 80 -j REDIRECT --to-port 
>8080
>
>Same question as above...
>
> > iptables -P FORWARD DROP
> > iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
> > iptables -A FORWARD -i eth0 -p tcp --dport 20        -j ACCEPT
> > iptables -A FORWARD -i eth0 -p udp --dport 20        -j ACCEPT
> > iptables -A FORWARD -i eth0 -p tcp --dport 21        -j ACCEPT
> > iptables -A FORWARD -i eth0 -p udp --dport 21        -j ACCEPT
>
>FTP does not use UDP, so two of the above four rules are irrelevant, and
>stateful packet filtering (which you are clearly using from the first rule 
>in
>your FORWARD chain) means that you do not need a rule for the data 
>connection
>on TCP port 20 - therefore you only need one of the above four rules:
>
>iptables -A FORWARD -i eth0 -p tcp --dport 21        -j ACCEPT
>
> > iptables -A FORWARD -i eth0 -p tcp --dport 443       -j ACCEPT
> > iptables -A FORWARD -i eth0 -p tcp --dport 5000      -j ACCEPT
> > iptables -A FORWARD -i eth0 -p tcp --dport 5001      -j ACCEPT
> > iptables -A FORWARD -i eth0 -p tcp --dport 5005      -j ACCEPT
> > iptables -A FORWARD -i eth0 -p tcp --dport 5050      -j ACCEPT
> > iptables -A FORWARD -i eth0 -p tcp --dport 6660:6670 -j ACCEPT
> > iptables -A FORWARD -i eth0 -p tcp --dport 7000      -j ACCEPT
> > #iptables -A FORWARD -i eth0 -p tcp --dport 28805     -j ACCEPT
> > iptables -A FORWARD -i eth0 -p tcp --dport 51215     -j ACCEPT
> >
> > iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
>
>Regards,
>
>Antony.
>
>--
>It is also possible that putting the birds in a laboratory setting
>inadvertently renders them relatively incompetent.
>
>  - Daniel C Dennet
>
>                                                      Please reply to the 
>list;
>                                                            please don't CC 
>me.
>
>

_________________________________________________________________
STOP MORE SPAM with the new MSN 8 and get 2 months FREE* 
http://join.msn.com/?page=features/junkmail



^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: ftp again
  2004-05-22 22:28 ftp again azeem ahmad
@ 2004-05-22 22:50 ` Antony Stone
  2004-06-15 14:35 ` Peter Marshall
  1 sibling, 0 replies; 7+ messages in thread
From: Antony Stone @ 2004-05-22 22:50 UTC (permalink / raw)
  To: netfilter

On Saturday 22 May 2004 11:28 pm, azeem ahmad wrote:

> i issued the commands
> #modprobe ip_nat_ftp
> #modprobe ip_conntrack_ftp
> and now it works well
> but what are these modules and what is the connection tracking. can u tell
> me about any usefull link

http://iptables-tutorial.frozentux.net/iptables-tutorial.html#STATEMACHINE
http://iptables-tutorial.frozentux.net/iptables-tutorial.html#COMPLEXPROTOCOLS

Regards,

Antony.

-- 
Never write it in Perl if you can do it in Awk.
Never do it in Awk if sed can handle it.
Never use sed when tr can do the job.
Never invoke tr when cat is sufficient.
Avoid using cat whenever possible.

                                                     Please reply to the list;
                                                           please don't CC me.



^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: ftp again
  2004-05-22 22:28 ftp again azeem ahmad
  2004-05-22 22:50 ` Antony Stone
@ 2004-06-15 14:35 ` Peter Marshall
  2004-06-15 14:57   ` Antony Stone
  1 sibling, 1 reply; 7+ messages in thread
From: Peter Marshall @ 2004-06-15 14:35 UTC (permalink / raw)
  To: azeem ahmad, netfilter

when I try to run the ip_conntrack_ftp module using the command
"modeprobe ip_conntrack_ftp" or
"/sbin/modeprobe ip_conntrack_ftp" it says module not found.

I searched for the module on my system and it does exist in
"/lib/modules/2.4.20-8/kernel/net/ipv4/netfilter/"

Any suggestions ?

I am running rh9

Peter

----- Original Message ----- 
From: "azeem ahmad" <azeem484@hotmail.com>
To: <netfilter@lists.netfilter.org>
Sent: Saturday, May 22, 2004 7:28 PM
Subject: Re: ftp again


i issued the commands
#modprobe ip_nat_ftp
#modprobe ip_conntrack_ftp
and now it works well
but what are these modules and what is the connection tracking. can u tell
me about any usefull link

Regards
Azeem


>From: Antony Stone <Antony@Soft-Solutions.co.uk>
>Reply-To: netfilter@lists.netfilter.org
>To: netfilter@lists.netfilter.org
>Subject: Re: ftp again
>Date: Sat, 22 May 2004 16:56:16 +0100
>
>On Saturday 22 May 2004 4:29 pm, azeem ahmad wrote:
>
> > hi all
> > when i run this script on my box the natting of ftp stops. neither
>clients
> > browse in non-paasive mode nor in passive mode
> > what is the problem
>
>Perhaps you do not have the nat_ftp and conntrack_ftp modules loaded or
>compiled into your kernel?
>
> > iptables -F
> > iptables -t nat -F
> > iptables -P INPUT DROP
> > iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
> > iptables -A INPUT -i eth0 -p tcp --dport 8080 -j ACCEPT
> > iptables -A INPUT -i eth0 -p udp --dport 8080 -j ACCEPT
>
>What are you using UDP port 8080 for?
>
> > iptables -A INPUT -i eth0 -p tcp --dport 22   -j ACCEPT
> > iptables -A INPUT -i eth0 -p tcp --dport 53   -j ACCEPT
> > iptables -A INPUT -i eth0 -p udp --dport 53   -j ACCEPT
> > iptables -A INPUT -i eth0 -p udp --dport 137  -j ACCEPT
> > iptables -A INPUT -i eth0 -p udp --dport 138  -j ACCEPT
> > iptables -A INPUT -i eth0 -p tcp --dport 139  -j ACCEPT
> >
> > iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port
>8080
> > iptables -t nat -A PREROUTING -p udp --dport 80 -j REDIRECT --to-port
>8080
>
>Same question as above...
>
> > iptables -P FORWARD DROP
> > iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
> > iptables -A FORWARD -i eth0 -p tcp --dport 20        -j ACCEPT
> > iptables -A FORWARD -i eth0 -p udp --dport 20        -j ACCEPT
> > iptables -A FORWARD -i eth0 -p tcp --dport 21        -j ACCEPT
> > iptables -A FORWARD -i eth0 -p udp --dport 21        -j ACCEPT
>
>FTP does not use UDP, so two of the above four rules are irrelevant, and
>stateful packet filtering (which you are clearly using from the first rule
>in
>your FORWARD chain) means that you do not need a rule for the data
>connection
>on TCP port 20 - therefore you only need one of the above four rules:
>
>iptables -A FORWARD -i eth0 -p tcp --dport 21        -j ACCEPT
>
> > iptables -A FORWARD -i eth0 -p tcp --dport 443       -j ACCEPT
> > iptables -A FORWARD -i eth0 -p tcp --dport 5000      -j ACCEPT
> > iptables -A FORWARD -i eth0 -p tcp --dport 5001      -j ACCEPT
> > iptables -A FORWARD -i eth0 -p tcp --dport 5005      -j ACCEPT
> > iptables -A FORWARD -i eth0 -p tcp --dport 5050      -j ACCEPT
> > iptables -A FORWARD -i eth0 -p tcp --dport 6660:6670 -j ACCEPT
> > iptables -A FORWARD -i eth0 -p tcp --dport 7000      -j ACCEPT
> > #iptables -A FORWARD -i eth0 -p tcp --dport 28805     -j ACCEPT
> > iptables -A FORWARD -i eth0 -p tcp --dport 51215     -j ACCEPT
> >
> > iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
>
>Regards,
>
>Antony.
>
>--
>It is also possible that putting the birds in a laboratory setting
>inadvertently renders them relatively incompetent.
>
>  - Daniel C Dennet
>
>                                                      Please reply to the
>list;
>                                                            please don't CC
>me.
>
>

_________________________________________________________________
STOP MORE SPAM with the new MSN 8 and get 2 months FREE*
http://join.msn.com/?page=features/junkmail




^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: ftp again
  2004-06-15 14:35 ` Peter Marshall
@ 2004-06-15 14:57   ` Antony Stone
  2004-06-15 15:10     ` Peter Marshall
  0 siblings, 1 reply; 7+ messages in thread
From: Antony Stone @ 2004-06-15 14:57 UTC (permalink / raw)
  To: netfilter

On Tuesday 15 June 2004 3:35 pm, Peter Marshall wrote:

> when I try to run the ip_conntrack_ftp module using the command
> "modeprobe ip_conntrack_ftp" or
> "/sbin/modeprobe ip_conntrack_ftp" it says module not found.
>
> I searched for the module on my system and it does exist in
> "/lib/modules/2.4.20-8/kernel/net/ipv4/netfilter/"

What does "uname -r" tell you for the kernel version you are running?

If this doesn't match 2.4.20-8 then modprobe (note spelling?) will not be able 
to find the above file.

Regards,

Antony.

-- 
There are only 10 types of people in the world:
those who understand binary notation,
and those who don't.

                                                     Please reply to the list;
                                                           please don't CC me.



^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: ftp again
  2004-06-15 14:57   ` Antony Stone
@ 2004-06-15 15:10     ` Peter Marshall
  0 siblings, 0 replies; 7+ messages in thread
From: Peter Marshall @ 2004-06-15 15:10 UTC (permalink / raw)
  To: netfilter

Thanks .. I should have replied to my message about 20 seconds after I
posted ... It is amazing how things will not work when you make a spelling
mistake

ie: modeprobe vis modprobe

Sorry to bother you with a question that involved my stupidity.

Peter


----- Original Message ----- 
From: "Antony Stone" <Antony@Soft-Solutions.co.uk>
To: <netfilter@lists.netfilter.org>
Sent: Tuesday, June 15, 2004 11:57 AM
Subject: Re: ftp again


On Tuesday 15 June 2004 3:35 pm, Peter Marshall wrote:

> when I try to run the ip_conntrack_ftp module using the command
> "modeprobe ip_conntrack_ftp" or
> "/sbin/modeprobe ip_conntrack_ftp" it says module not found.
>
> I searched for the module on my system and it does exist in
> "/lib/modules/2.4.20-8/kernel/net/ipv4/netfilter/"

What does "uname -r" tell you for the kernel version you are running?

If this doesn't match 2.4.20-8 then modprobe (note spelling?) will not be
able
to find the above file.

Regards,

Antony.

-- 
There are only 10 types of people in the world:
those who understand binary notation,
and those who don't.

                                                     Please reply to the
list;
                                                           please don't CC
me.




^ permalink raw reply	[flat|nested] 7+ messages in thread

end of thread, other threads:[~2004-06-15 15:10 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2004-05-22 22:28 ftp again azeem ahmad
2004-05-22 22:50 ` Antony Stone
2004-06-15 14:35 ` Peter Marshall
2004-06-15 14:57   ` Antony Stone
2004-06-15 15:10     ` Peter Marshall
  -- strict thread matches above, loose matches on Subject: below --
2004-05-22 15:29 azeem ahmad
2004-05-22 15:56 ` Antony Stone

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox