From mboxrd@z Thu Jan 1 00:00:00 1970 From: "azeem ahmad" Subject: Re: ftp again Date: Sat, 22 May 2004 22:28:03 +0000 Sender: netfilter-admin@lists.netfilter.org Message-ID: Mime-Version: 1.0 Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; format=flowed; charset="us-ascii" Content-Transfer-Encoding: 7bit To: netfilter@lists.netfilter.org i issued the commands #modprobe ip_nat_ftp #modprobe ip_conntrack_ftp and now it works well but what are these modules and what is the connection tracking. can u tell me about any usefull link Regards Azeem >From: Antony Stone >Reply-To: netfilter@lists.netfilter.org >To: netfilter@lists.netfilter.org >Subject: Re: ftp again >Date: Sat, 22 May 2004 16:56:16 +0100 > >On Saturday 22 May 2004 4:29 pm, azeem ahmad wrote: > > > hi all > > when i run this script on my box the natting of ftp stops. neither >clients > > browse in non-paasive mode nor in passive mode > > what is the problem > >Perhaps you do not have the nat_ftp and conntrack_ftp modules loaded or >compiled into your kernel? > > > iptables -F > > iptables -t nat -F > > iptables -P INPUT DROP > > iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT > > iptables -A INPUT -i eth0 -p tcp --dport 8080 -j ACCEPT > > iptables -A INPUT -i eth0 -p udp --dport 8080 -j ACCEPT > >What are you using UDP port 8080 for? > > > iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT > > iptables -A INPUT -i eth0 -p tcp --dport 53 -j ACCEPT > > iptables -A INPUT -i eth0 -p udp --dport 53 -j ACCEPT > > iptables -A INPUT -i eth0 -p udp --dport 137 -j ACCEPT > > iptables -A INPUT -i eth0 -p udp --dport 138 -j ACCEPT > > iptables -A INPUT -i eth0 -p tcp --dport 139 -j ACCEPT > > > > iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port >8080 > > iptables -t nat -A PREROUTING -p udp --dport 80 -j REDIRECT --to-port >8080 > >Same question as above... > > > iptables -P FORWARD DROP > > iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT > > iptables -A FORWARD -i eth0 -p tcp --dport 20 -j ACCEPT > > iptables -A FORWARD -i eth0 -p udp --dport 20 -j ACCEPT > > iptables -A FORWARD -i eth0 -p tcp --dport 21 -j ACCEPT > > iptables -A FORWARD -i eth0 -p udp --dport 21 -j ACCEPT > >FTP does not use UDP, so two of the above four rules are irrelevant, and >stateful packet filtering (which you are clearly using from the first rule >in >your FORWARD chain) means that you do not need a rule for the data >connection >on TCP port 20 - therefore you only need one of the above four rules: > >iptables -A FORWARD -i eth0 -p tcp --dport 21 -j ACCEPT > > > iptables -A FORWARD -i eth0 -p tcp --dport 443 -j ACCEPT > > iptables -A FORWARD -i eth0 -p tcp --dport 5000 -j ACCEPT > > iptables -A FORWARD -i eth0 -p tcp --dport 5001 -j ACCEPT > > iptables -A FORWARD -i eth0 -p tcp --dport 5005 -j ACCEPT > > iptables -A FORWARD -i eth0 -p tcp --dport 5050 -j ACCEPT > > iptables -A FORWARD -i eth0 -p tcp --dport 6660:6670 -j ACCEPT > > iptables -A FORWARD -i eth0 -p tcp --dport 7000 -j ACCEPT > > #iptables -A FORWARD -i eth0 -p tcp --dport 28805 -j ACCEPT > > iptables -A FORWARD -i eth0 -p tcp --dport 51215 -j ACCEPT > > > > iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE > >Regards, > >Antony. > >-- >It is also possible that putting the birds in a laboratory setting >inadvertently renders them relatively incompetent. > > - Daniel C Dennet > > Please reply to the >list; > please don't CC >me. > > _________________________________________________________________ STOP MORE SPAM with the new MSN 8 and get 2 months FREE* http://join.msn.com/?page=features/junkmail