Re: I still have no idea why this doesn't work...(further details)

Re: I still have no idea why this doesn't work...(further details)

[makahou]

At 03:57 PM 4/23/04 +0100, Antony Stone wrote:
># Set default drop polcy on all tables
>iptables -P INPUT DROP
>iptables -P OUTPUT DROP
>iptables -P FORWARD DROP
>
># Allow replies out for anything which comes in
>iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
># Allow the machine to do its own DNS lookups
>iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
>iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
># Allow replies in for anything which goes out (eg DNS)
>iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
># Allow the world to access by HTTP
>iptables -A INPUT -p tcp --dport 80 -j ACCEPT
># Allow the world to access by FTP (you *did* want that, yes?)
>iptables -A INPUT -p tcp --dport 21 -j ACCEPT
># Allow the world to access by SSH (would be nicer to restrict by IP addres,
>but we can't, so....)
>iptables -A INPUT -p tcp --dport 22 -j ACCEPT

Okay, I did this, and received the following when I tried to FTP into the site:
   i Control connection successfully established.
   < 220 ProFTPD FTP Server ready.
   i Time zone of server could not be determined.
   > USER admin
   < 331 Password required for admin.
   > PASS <password>
   < 230 User admin logged in.
   > SYST
   < 215 UNIX Type: L8
   > PWD
   < 257 "/home/admin" is current directory.
   > PASV
   < 227 Entering Passive Mode (207,36,232,90,132,36).
   i Data connection A8 could not be established (10060).
followed by a notice that the connection timed out.  Changing the FTP 
parameters didn't have much effect.  Also, the browser connects to the 
site, but times out before displaying any data.  And everything is *s-l-o-w*.

Any ideas? 

Re: I still have no idea why this doesn't work...(further details)

[Garison Piatt]

At 03:57 PM 4/23/04 +0100, Antony Stone wrote:
># Set default drop polcy on all tables
>iptables -P INPUT DROP
>iptables -P OUTPUT DROP
>iptables -P FORWARD DROP
>
># Allow replies out for anything which comes in
>iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
># Allow the machine to do its own DNS lookups
>iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
>iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
># Allow replies in for anything which goes out (eg DNS)
>iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
># Allow the world to access by HTTP
>iptables -A INPUT -p tcp --dport 80 -j ACCEPT
># Allow the world to access by FTP (you *did* want that, yes?)
>iptables -A INPUT -p tcp --dport 21 -j ACCEPT
># Allow the world to access by SSH (would be nicer to restrict by IP addres,
>but we can't, so....)
>iptables -A INPUT -p tcp --dport 22 -j ACCEPT

Okay, I did this, and received the following when I tried to FTP into the site:
   i Control connection successfully established.
   < 220 ProFTPD FTP Server ready.
   i Time zone of server could not be determined.
   > USER admin
   < 331 Password required for admin.
   > PASS <password>
   < 230 User admin logged in.
   > SYST
   < 215 UNIX Type: L8
   > PWD
   < 257 "/home/admin" is current directory.
   > PASV
   < 227 Entering Passive Mode (207,36,232,90,132,36).
   i Data connection A8 could not be established (10060).
followed by a notice that the connection timed out.  Changing the FTP 
parameters didn't have much effect.  Also, the browser connects to the 
site, but times out before displaying any data.  And everything is *s-l-o-w*.

Any ideas?  

Re: I still have no idea why this doesn't work...(further details)

[IT Clown]

have you tried: modprobe ip_nat_ftp
Try iptables -A INPUT -p tcp --dport 20 -j ACCEPT
                                                            
                   
with your current rule of --dport 21


On Sat, 24 Apr 2004 18:53:43 -1000
 Garison Piatt <todo@garisonpiatt.com> wrote:
> At 03:57 PM 4/23/04 +0100, Antony Stone wrote:
> ># Set default drop polcy on all tables
> >iptables -P INPUT DROP
> >iptables -P OUTPUT DROP
> >iptables -P FORWARD DROP
> >
> ># Allow replies out for anything which comes in
> >iptables -A OUTPUT -m state --state ESTABLISHED,RELATED
> -j ACCEPT
> ># Allow the machine to do its own DNS lookups
> >iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
> >iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
> ># Allow replies in for anything which goes out (eg DNS)
> >iptables -A INPUT -m state --state ESTABLISHED,RELATED
> -j ACCEPT
> ># Allow the world to access by HTTP
> >iptables -A INPUT -p tcp --dport 80 -j ACCEPT
> ># Allow the world to access by FTP (you *did* want that,
> yes?)
> >iptables -A INPUT -p tcp --dport 21 -j ACCEPT
> ># Allow the world to access by SSH (would be nicer to
> restrict by IP addres,
> >but we can't, so....)
> >iptables -A INPUT -p tcp --dport 22 -j ACCEPT
> 
> Okay, I did this, and received the following when I tried
> to FTP into the site:
>    i Control connection successfully established.
>    < 220 ProFTPD FTP Server ready.
>    i Time zone of server could not be determined.
>    > USER admin
>    < 331 Password required for admin.
>    > PASS <password>
>    < 230 User admin logged in.
>    > SYST
>    < 215 UNIX Type: L8
>    > PWD
>    < 257 "/home/admin" is current directory.
>    > PASV
>    < 227 Entering Passive Mode (207,36,232,90,132,36).
>    i Data connection A8 could not be established (10060).
> followed by a notice that the connection timed out.
>  Changing the FTP parameters didn't have much effect.
>  Also, the browser connects to the site, but times out
> before displaying any data.  And everything is *s-l-o-w*.
> 
> Any ideas?  
> 

______________________________________________________________
Herbalife Independent Distributor http://www.healthiest.co.za

Re: I still have no idea why this doesn't work...(further details)

[Antony Stone]

On Sunday 25 April 2004 7:59 am, IT Clown wrote:

> have you tried: modprobe ip_nat_ftp

Why would he need ip_nat_ftp with rules in the INPUT chain?   There's no nat 
going on.

However, you have raised the question of whether he has compiled in or loaded 
as a module ip_conntrack_ftp support?   That would be needed in this 
situation.

Regards,

Antony.

> On Sat, 24 Apr 2004 18:53:43 -1000
>
>  Garison Piatt <todo@garisonpiatt.com> wrote:
>
> >    i Control connection successfully established.
> >    < 220 ProFTPD FTP Server ready.
> >    i Time zone of server could not be determined.
> >    > USER admin
> >    < 331 Password required for admin.
> >    > PASS <password>
> >    < 230 User admin logged in.
> >    > SYST
> >    < 215 UNIX Type: L8
> >    > PWD
> >    < 257 "/home/admin" is current directory.
> >    > PASV
> >    < 227 Entering Passive Mode (207,36,232,90,132,36).
> >    i Data connection A8 could not be established (10060).
> > followed by a notice that the connection timed out.

-- 
Late in 1972 President Richard Nixon announced that the rate of increase of 
inflation was decreasing.   This was the first time a sitting president used 
a third derivative to advance his case for re-election.

 - Hugo Rossi, Notices of the American Mathematical Society

                                                     Please reply to the list;
                                                           please don't CC me.