Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.os.linux.networking > #4191
| From | Pascal Hambourg <pascal@plouf.fr.eu.org> |
|---|---|
| Newsgroups | comp.os.linux.networking |
| Subject | Re: Need help with iptables and ftp |
| Date | 2018-08-26 11:35 +0200 |
| Organization | Plouf ! |
| Message-ID | <plts91$2k58$1@saria.nerim.net> (permalink) |
| References | <plq1fe$amg$1@dont-email.me> <slrnpo20v9.31ka.grahn+nntp@frailea.sa.invalid> <pltgel$qaa$1@dont-email.me> |
Le 26/08/2018 à 08:13, T a écrit :
>
> Here are my notes:
And here are my comments.
> How to track ftp's high port with Fedora and iptables:
>
> Problem: iptables will not automatically track ftp's high ports
> (firewalld will).
Iptables does not track anything by itself. Netfilter's connection
tracking aka "conntrack" does. Iptables just uses the resulting state.
There are no such "FTP high ports", but FTP active and passive data
connections. FTP active data connections use port 20 which is obviously
not "high".
> Note: RHEL used
> ip_conntrack_ftp, and
> ip_nat_ftp
>
> These have been superseded by
> nf_conntrack_ftp
> nf_conntrack_tftp
> nf_nat_ftp
> nf_nat_tftp
nf_{conntrack|nat}_tftp modules are for the TFTP protocol, which is a
totally different protocol from FTP despite the close names. TFTP uses
UDP and a different control port.
ip_{conntrack|nat}_* are now aliases of nf_{conntrack|nat}_* modules, so
you can still use them if you want.
> 2) nf_conntrack_ftp is disabled by default. To enable it:
> # echo 1 > /proc/sys/net/netfilter/nf_conntrack_helper
nf_conntrack_ftp is not disabled by default.
What has been disabled by default in recent kernels is the automatic
assignment of all conntrack helpers to connections.
Automatic assignment can also be enabled when the module is loaded with
the option nf_conntrack_helper=1.
But be aware that enabling automatic helper assignment is discouraged
(hence it was disabled by default). It is recommended to use explicit
assignment with the CT target instead.
On a client :
iptables -t raw -A OUTPUT -p tcp --dport 21 -j CT --helper ftp
On a server or router
iptables -t raw -A PREROUTING -p tcp --dport 21 -j CT --helper ftp
> 3) in /etc/modprobe.d/iptables.conf add
>
> nf_conntrack_ftp ports=21
Syntax error. You must prepend "options" to the line.
Port 21 is already the default, so you do not have to specify it.
> 4) restart iptables
> # systemctl restart iptables
>
> Note: you also have to reload your firewall rules after this too.
No you don't need to reload the ruleset, unless you changed it (e.g. you
added CT rules). Just loading helper modules and enabling automatic
helper assignment does not require to reload iptables rules.
> Sample passive and active ftp rules:
(...)
> Active:
>
> $tbls -A dsl-out -o $eth1 -p tcp -s $eth1_addr --sport $allports
> --dport ftp-data -m state --state ESTABLISHED -j ACCEPT
> $tbls -A dsl-in -i $eth1 -p tcp --sport ftp-data -d $eth1_addr
> --dport $unassgn -m state --state RELATED,ESTABLISHED -j ACCEPT
Can you explain why do specify different dynamic port ranges $allports
and $unassgn ?
> $tbls -A dsl-for -i $eth1 -p tcp --sport ftp-data -d
> $internal_net --dport $unassgn -m state --state RELATED,ESTABLISHED -j
> ACCEPT
The rule accepting packets in the other direction is missing.
> Passive:
>
> $tbls -A dsl-out -o $eth1 -p tcp -s $eth1_addr --sport $unassgn
> --dport ftp -m conntrack --ctstate NEW,ESTABLISHED -j
> ACCEPT
> $tbls -A dsl-in -i $eth1 -p tcp ! --syn --sport ftp -d $eth1_addr
> --dport $unassgn -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
> $tbls -A dsl-for -i $eth1 -p tcp ! --syn --sport ftp -d $internal_net
> --dport $unassgn -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
These rules allowing FTP control connections are not specific to passive
mode. They are also used in active mode.
The RELATED state should not be used in control connection rules. It
applies to data connections (replacing NEW), not control connections.
> $tbls -A dsl-out -o $eth1 -p tcp -s $eth1_addr -d $ANY_IP -m
> helper --helper ftp -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
> $tbls -A dsl-in -i $eth1 -p tcp ! --syn -s $ANY_IP -d $eth1_addr -m
> helper --helper ftp -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
> $tbls -A dsl-for -i $eth1 -p tcp ! --syn -s $ANY_IP -d $internal_net
> -m helper --helper ftp -m conntrack --ctstate RELATED,ESTABLISHED -j
> ACCEPT
On client side, the last two rules should not use the RELATED state (so
the helper match is useless).
Back to comp.os.linux.networking | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-24 15:39 -0700
Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-24 16:11 -0700
Re: Need help with iptables and ftp Jorgen Grahn <grahn+nntp@snipabacken.se> - 2018-08-25 07:23 +0000
Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-25 23:13 -0700
Re: Need help with iptables and ftp Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-08-26 11:35 +0200
Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-26 14:05 -0700
Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-27 00:02 +0000
Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-26 17:11 -0700
Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-27 02:00 +0000
Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-26 19:37 -0700
Re: Need help with iptables and ftp "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2018-08-26 22:59 -0400
Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-26 20:42 -0700
Re: Need help with iptables and ftp "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2018-08-27 00:29 -0400
Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-26 22:06 -0700
Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-27 09:47 +0000
Re: Need help with iptables and ftp Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-03 20:47 +0200
Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-27 09:44 +0000
Re: Need help with iptables and ftp "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2018-08-27 06:17 -0400
Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-27 12:21 -0700
Re: Need help with iptables and ftp Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-03 20:55 +0200
Re: Need help with iptables and ftp Scott Hemphill <hemphill@hemphills.net> - 2018-08-27 11:22 -0400
Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-27 12:18 -0700
Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-26 17:44 -0700
Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-26 17:43 -0700
Re: Need help with iptables and ftp Dan Purgert <dan@djph.net> - 2018-08-28 11:28 +0000
Re: Need help with iptables and ftp Jorgen Grahn <grahn+nntp@snipabacken.se> - 2018-08-29 05:38 +0000
Re: Need help with iptables and ftp Tauno Voipio <tauno.voipio@notused.fi.invalid> - 2018-08-29 10:13 +0300
Re: Need help with iptables and ftp Dan Purgert <dan@djph.net> - 2018-08-29 09:52 +0000
Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-29 12:13 +0000
Re: Need help with iptables and ftp Dan Purgert <dan@djph.net> - 2018-08-29 12:27 +0000
Re: Need help with iptables and ftp "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2018-08-29 11:14 -0400
Re: Need help with iptables and ftp Aragorn <thorongil@telenet.be> - 2018-08-29 23:15 +0200
Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-08-30 10:35 +0200
Re: Need help with iptables and ftp Jorgen Grahn <grahn+nntp@snipabacken.se> - 2018-08-30 13:16 +0000
Re: Need help with iptables and ftp Richard Kettlewell <invalid@invalid.invalid> - 2018-08-30 16:15 +0100
Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-08-30 18:42 +0200
Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-31 00:31 +0000
Re: Need help with iptables and ftp Jorgen Grahn <grahn+nntp@snipabacken.se> - 2018-08-31 05:49 +0000
Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-08-31 12:48 +0200
Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-31 22:11 +0000
Re: Need help with iptables and ftp Tauno Voipio <tauno.voipio@notused.fi.invalid> - 2018-09-01 09:56 +0300
Re: Need help with iptables and ftp Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-01 16:14 +0200
Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-09-04 18:00 +0200
Re: Need help with iptables and ftp Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-04 20:36 +0200
Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-09-05 10:25 +0200
Re: Need help with iptables and ftp Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-05 20:30 +0200
Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-09-06 00:03 +0200
Re: Need help with iptables and ftp Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-01 15:56 +0200
Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-09-01 19:18 +0000
Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-09-04 18:01 +0200
Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-31 00:25 +0000
Re: Need help with iptables and ftp "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2018-08-30 20:34 -0400
Re: Need help with iptables and ftp Dan Purgert <dan@djph.net> - 2018-08-31 09:25 +0000
Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-08-31 12:50 +0200
Re: Need help with iptables and ftp Dan Purgert <dan@djph.net> - 2018-08-31 11:13 +0000
Re: Need help with iptables and ftp Allodoxaphobia <knock_yourself_out@example.net> - 2018-08-31 12:30 +0000
csiph-web