Groups > comp.os.linux.networking > #4190

Re: Need help with iptables and ftp

From	T <T@invalid.invalid>
Newsgroups	comp.os.linux.networking
Subject	Re: Need help with iptables and ftp
Date	2018-08-25 23:13 -0700
Organization	A noiseless patient Spider
Message-ID	<pltgel$qaa$1@dont-email.me> (permalink)
References	<plq1fe$amg$1@dont-email.me> <slrnpo20v9.31ka.grahn+nntp@frailea.sa.invalid>

Show all headers | View raw

On 08/25/2018 12:23 AM, Jorgen Grahn wrote:
> On Fri, 2018-08-24, T wrote:
>> Hi All,
>>
>> Fedora 28
>>
>> # uname -r
>> 4.17.12-200.fc28.x86_64
>>
>> Since switching from RHEL to Fedora 28, my iptables
>> no longer tracks the high ports used by ftp.
> 
> This is active mode ftp, right?  The one where the client says "please
> contact me on port NNNNN and dump your data there"?
> 
> I'm surprised you have a need for it; it seems to me all clients have
> defaulted to passive mode for at least a decade.  At least, the
> problem just disappeared for me some time around then, and it's not
> due to configuration on my part.
> 
> /Jorgen
> 

Hi Jorgen,

Both passive and active.  I did figure it out.

Keep in mnd that iptables-config no longer loads
"IPTABLES_MODULES=". I will bugzilla it when their
web site comes back up.

-T


Here are my notes:

How to track ftp's high port with Fedora and iptables:

Problem: iptables will not automatically track ftp's high ports 
(firewalld will).


Note: RHEL used
    ip_conntrack_ftp,  and
    ip_nat_ftp

These have been superseded by
    nf_conntrack_ftp
    nf_conntrack_tftp
    nf_nat_ftp
    nf_nat_tftp


To set up ftp high port tracking.

1) in /etc/sysconfig/iptables-config add (under this first erase add)

      IPTABLES_MODULES="nf_conntrack_ftp nf_conntrack_tftp nf_nat_ftp 
nf_nat_tftp"


2) nf_conntrack_ftp is disabled by default.  To enable it:
      # echo 1 > /proc/sys/net/netfilter/nf_conntrack_helper


3) in /etc/modprobe.d/iptables.conf add

      nf_conntrack_ftp ports=21


4) restart iptables
      # systemctl restart iptables

    Note: you also have to reload your firewall rules after this too.


5) to check modules

      # lsmod | grep ftp


Notes:
    filters are part of the kernal and are located in
       /lib/modules/`uname -r`/kernel/net/netfilter
    to use them, remove the ".ko.xz"

    manual filter adds (disappear after a reboot):
       # modprobe nf_conntrack_ftp
       # modprobe nf_conntrack_tftp
       # modprobe nf_nat_ftp
       # modprobe nf_nat_tftp


Sample passive and active ftp rules:


tbls=/sbin/iptables

if [ "$(cat /proc/sys/net/netfilter/nf_conntrack_helper)" == "0" ]; then
    echo "echo 1 > /proc/sys/net/netfilter/nf_conntrack_helper"
    echo 1 > /proc/sys/net/netfilter/nf_conntrack_helper
fi


Active:

    $tbls -A dsl-out  -o $eth1  -p tcp  -s $eth1_addr --sport $allports 
--dport ftp-data -m state --state ESTABLISHED         -j ACCEPT
    $tbls -A dsl-in   -i $eth1  -p tcp  --sport ftp-data -d $eth1_addr 
--dport $unassgn -m state --state RELATED,ESTABLISHED  -j ACCEPT
    $tbls -A dsl-for  -i $eth1  -p tcp  --sport ftp-data -d 
$internal_net --dport $unassgn -m state --state RELATED,ESTABLISHED  -j 
ACCEPT

Passive:

$tbls -A dsl-out  -o $eth1  -p tcp  -s $eth1_addr --sport $unassgn 
--dport ftp         -m conntrack --ctstate NEW,ESTABLISHED           -j 
ACCEPT
$tbls -A dsl-in   -i $eth1  -p tcp  ! --syn --sport ftp -d $eth1_addr 
--dport $unassgn -m conntrack --ctstate RELATED,ESTABLISHED       -j ACCEPT
$tbls -A dsl-for  -i $eth1  -p tcp  ! --syn --sport ftp -d $internal_net 
  --dport $unassgn  -m conntrack --ctstate RELATED,ESTABLISHED  -j ACCEPT
$tbls -A dsl-out  -o $eth1  -p tcp  -s $eth1_addr       -d $ANY_IP 
-m helper --helper ftp -m conntrack --ctstate RELATED,ESTABLISHED  -j ACCEPT
$tbls -A dsl-in   -i $eth1  -p tcp  ! --syn  -s $ANY_IP -d $eth1_addr 
-m helper --helper ftp -m conntrack --ctstate RELATED,ESTABLISHED  -j ACCEPT
$tbls -A dsl-for  -i $eth1  -p tcp  ! --syn  -s $ANY_IP -d $internal_net 
-m helper --helper ftp -m conntrack --ctstate RELATED,ESTABLISHED  -j ACCEPT

Thread

Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-24 15:39 -0700
  Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-24 16:11 -0700
  Re: Need help with iptables and ftp Jorgen Grahn <grahn+nntp@snipabacken.se> - 2018-08-25 07:23 +0000
    Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-25 23:13 -0700
      Re: Need help with iptables and ftp Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-08-26 11:35 +0200
        Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-26 14:05 -0700
          Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-27 00:02 +0000
            Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-26 17:11 -0700
              Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-27 02:00 +0000
                Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-26 19:37 -0700
                Re: Need help with iptables and ftp "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2018-08-26 22:59 -0400
                Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-26 20:42 -0700
                Re: Need help with iptables and ftp "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2018-08-27 00:29 -0400
                Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-26 22:06 -0700
                Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-27 09:47 +0000
                Re: Need help with iptables and ftp Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-03 20:47 +0200
                Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-27 09:44 +0000
                Re: Need help with iptables and ftp "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2018-08-27 06:17 -0400
                Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-27 12:21 -0700
                Re: Need help with iptables and ftp Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-03 20:55 +0200
                Re: Need help with iptables and ftp Scott Hemphill <hemphill@hemphills.net> - 2018-08-27 11:22 -0400
                Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-27 12:18 -0700
          Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-26 17:44 -0700
      Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-26 17:43 -0700
  Re: Need help with iptables and ftp Dan Purgert <dan@djph.net> - 2018-08-28 11:28 +0000
    Re: Need help with iptables and ftp Jorgen Grahn <grahn+nntp@snipabacken.se> - 2018-08-29 05:38 +0000
      Re: Need help with iptables and ftp Tauno Voipio <tauno.voipio@notused.fi.invalid> - 2018-08-29 10:13 +0300
      Re: Need help with iptables and ftp Dan Purgert <dan@djph.net> - 2018-08-29 09:52 +0000
        Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-29 12:13 +0000
          Re: Need help with iptables and ftp Dan Purgert <dan@djph.net> - 2018-08-29 12:27 +0000
            Re: Need help with iptables and ftp "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2018-08-29 11:14 -0400
              Re: Need help with iptables and ftp Aragorn <thorongil@telenet.be> - 2018-08-29 23:15 +0200
              Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-08-30 10:35 +0200
                Re: Need help with iptables and ftp Jorgen Grahn <grahn+nntp@snipabacken.se> - 2018-08-30 13:16 +0000
                Re: Need help with iptables and ftp Richard Kettlewell <invalid@invalid.invalid> - 2018-08-30 16:15 +0100
                Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-08-30 18:42 +0200
                Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-31 00:31 +0000
                Re: Need help with iptables and ftp Jorgen Grahn <grahn+nntp@snipabacken.se> - 2018-08-31 05:49 +0000
                Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-08-31 12:48 +0200
                Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-31 22:11 +0000
                Re: Need help with iptables and ftp Tauno Voipio <tauno.voipio@notused.fi.invalid> - 2018-09-01 09:56 +0300
                Re: Need help with iptables and ftp Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-01 16:14 +0200
                Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-09-04 18:00 +0200
                Re: Need help with iptables and ftp Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-04 20:36 +0200
                Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-09-05 10:25 +0200
                Re: Need help with iptables and ftp Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-05 20:30 +0200
                Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-09-06 00:03 +0200
                Re: Need help with iptables and ftp Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-01 15:56 +0200
                Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-09-01 19:18 +0000
                Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-09-04 18:01 +0200
                Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-31 00:25 +0000
                Re: Need help with iptables and ftp "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2018-08-30 20:34 -0400
                Re: Need help with iptables and ftp Dan Purgert <dan@djph.net> - 2018-08-31 09:25 +0000
                Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-08-31 12:50 +0200
                Re: Need help with iptables and ftp Dan Purgert <dan@djph.net> - 2018-08-31 11:13 +0000
                Re: Need help with iptables and ftp Allodoxaphobia <knock_yourself_out@example.net> - 2018-08-31 12:30 +0000

csiph-web