Re: iptables and FTP

From: Alessandro Selli (adoro.lo.spam_at_libero.it)
Date: 05/14/03 

Date: Wed, 14 May 2003 16:30:18 +0200

Il giorno Wed, 14 May 2003, charly cosė ha scritto:

|From: charly <kanari@yahoo.fr>
|Date: Wed, 14 May 2003 11:52:12 +0200
|Subject: iptables and FTP
|
|Greetings,
|
|My box is a linux distro is mandrake.
|I installed iptables and it works nearly ok :)
|
|I cannot get filelist from ftp servers : I can login/pass but get a
|connection time out when trying to acces the file list.
|I think there must be something wrong in my script regarding iptables
|configuration :

[...]

|$protec -A OUTPUT -o eth0 --protocol tcp --destination-port 20 -j ACCEPT
|$protec -A OUTPUT -o eth0 --protocol tcp --destination-port 21 -j ACCEPT

  The problem with ftp is that ftp connections are established though port 21,
but the data transfer goes through port 20. There's a "ftp" specific module
to track these packets:

make menuconfig
         Networking options --->
         IP: Netfilter Configuration --->
         <M> FTP protocol support (NEW)

  x CONFIG_IP_NF_FTP: x
  x x
  x Tracking FTP connections is problematic: special helpers are x
  x required for tracking them, and doing masquerading and other forms x
  x of Network Address Translation on them. x
  x x
  x If you want to compile it as a module, say M here and read x
  x Documentation/modules.txt. If unsure, say Y'. x

  Sandro 

-- 
Bellum se ipsum alet
       La guerra nutre se stessa
Livio, Ab urbe condita, XXXIV,9

Relevant Pages

  • Problem with FTP and firewall
    ... when I wanted to allow the access to a service I was opening that port ... The problem is with FTP, i thought that using passive was the solution ... The problem is that I am seeing that ftp servers in passive mode don't ... the ftp connection starts with iptables, or some kind of module to be ...
    (comp.os.linux.networking)
  • Re: Iptables FTP question
    ... > My version of IPTABLES is: ... Active connection will have a high numbered port on the client, ... connection of the FTP protocol. ...
    (comp.security.firewalls)
  • Re: Questions on secure remote access to Fedora Core 2
    ... After most of a day of research on iptables, and a bunch of trial and ... Keep HTTP and HTTPS open for everybody ... Open inbound SSH, FTP, and mail for everybody ... ... users who for whatever reason can't use SFTP. ...
    (comp.os.linux.security)
  • Re: allowing passive FTP from the outside
    ... Also when I shut iptables down, it works, I can get a ftp ... Turning off iptables just opens all the ports. ... This may be possible with other ftp servers. ... then wouldn't this mean that FTP on regular port 21 would not work at all ...
    (Fedora)
  • Re: FTP Problems RH 7.3 Iptables
    ... > New install of Red Hat 7.3. ... When I try to use Mozilla 1.0 to download a file from an FTP ... > iptables or an iptables rule problem. ... When I have a firewall problem I fire up Ethereal and use it with and then ...
    (comp.security.firewalls)