A note about firewalls and ftp servers.

From: Rob 'Feztaa' Park (fezziker@home.com)
Date: 09/27/01 

Date: Wed, 26 Sep 2001 16:38:29 -0600 (MDT)
From: Rob 'Feztaa' Park <fezziker@home.com>
To: Bugtraq - Focus Linux <focus-linux@securityfocus.com>
Subject: A note about firewalls and ftp servers.
Message-ID: <Pine.LNX.4.33L2.0109261634400.4166-100000@feztron.ath.cx>

I've noticed a few people asking about getting their firewalls to let ftp
connections work properly.

I'll now briefly detail my experiences with proftpd and iptables:

Symptom: users can connect to ftp server, but can't receive directory
listings or files.

Problem: iptables allows traffic through on port 21, but not 20.

Solution: Either set up iptables to accept traffic on port 20, or set up
connection tracking and allow iptables to accept related and established
connections. 

-- 
Rob 'Feztaa' Park
fezziker@home.com
--
The IBM purchase of ROLM gives new meaning to the term "twisted pair".
		-- Howard Anderson, "Yankee Group"

Relevant Pages

  • Re: OT: Whats the deal with Ubuntu?
    ... I'm not saying that - iptables is there. ... Firewalls on hosts that aren't doing routing are just there to cover ... a connection you won't accept connections with or without a firewall. ...
    (Fedora)
  • IPTables Established connection problem.
    ... I posted a couple weeks ago about IPTables possibly losing state. ... My established connections still freeze if I have firewalling ... $IPT -F OUTPUT ... #Log martians (packets with impossible addresses) ...
    (comp.os.linux.security)
  • Re: network / performance problems
    ... > due to some bug in whatever is dynamically adding firewall rules to your system. ... I *do* run iptables on all of these machines. ... # Allow this host to establish new connections. ...
    (Linux-Kernel)
  • Re: network / performance problems
    ... > adopted the habit of compiling netfilter stuff as modules, ... > statically link everything and run it that way to see what I can see. ... and use iptables to set up connection tracking rules (as ... # Allow this host to establish new connections. ...
    (Linux-Kernel)
  • Re: firewall problems killing tomcat and apache
    ... I am trying to run apache and tomcat servers to serve content and apps for the internal LAN, ... I know tomcat needs ports 8009, 8080 and 8443 by default, and I studied my iptables script but it looks fine. ... I remember Netscape used to do IPC through TCP/IP connections to localhost. ...
    (Debian-User)