Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.os.linux.networking > #4192
| From | T <T@invalid.invalid> |
|---|---|
| Newsgroups | comp.os.linux.networking |
| Subject | Re: Need help with iptables and ftp |
| Date | 2018-08-26 14:05 -0700 |
| Organization | A noiseless patient Spider |
| Message-ID | <plv4mb$ft6$1@dont-email.me> (permalink) |
| References | <plq1fe$amg$1@dont-email.me> <slrnpo20v9.31ka.grahn+nntp@frailea.sa.invalid> <pltgel$qaa$1@dont-email.me> <plts91$2k58$1@saria.nerim.net> |
On 08/26/2018 02:35 AM, Pascal Hambourg wrote:
> Le 26/08/2018 à 08:13, T a écrit :
>>
>> Here are my notes:
>
> And here are my comments.
>
>> How to track ftp's high port with Fedora and iptables:
>>
>> Problem: iptables will not automatically track ftp's high ports
>> (firewalld will).
>
> Iptables does not track anything by itself. Netfilter's connection
> tracking aka "conntrack" does. Iptables just uses the resulting state.
>
> There are no such "FTP high ports",
http://slacksite.com/other/ftp.html#passive
From the server-side firewall's standpoint, to support passive mode
FTP the following communication channels need to be opened:
FTP server's port 21 from anywhere (Client initiates connection)
FTP server's port 21 to ports > 1023 (Server responds to client's
control port)
FTP server's ports > 1023 from anywhere (Client initiates data
connection to random port specified by server)
FTP server's ports > 1023 to remote ports > 1023 (Server sends ACKs
(and data) to client's data port)
Basically, after the connection is established, communications in
passive mode switches to all high ports.
This is a pain in the ass to track, so nf_conntrack_ftp was
created
> but FTP active and passive data
> connections. FTP active data connections use port 20 which is obviously
> not "high".
>
>> Note: RHEL used
>> ip_conntrack_ftp, and
>> ip_nat_ftp
>>
>> These have been superseded by
>> nf_conntrack_ftp
>> nf_conntrack_tftp
>> nf_nat_ftp
>> nf_nat_tftp
>
> nf_{conntrack|nat}_tftp modules are for the TFTP protocol, which is a
> totally different protocol from FTP despite the close names. TFTP uses
> UDP and a different control port.
>
You bet. I use tftp too
> ip_{conntrack|nat}_* are now aliases of nf_{conntrack|nat}_* modules, so
> you can still use them if you want.
I googled my ass off to figure that on out.
>
>> 2) nf_conntrack_ftp is disabled by default. To enable it:
>> # echo 1 > /proc/sys/net/netfilter/nf_conntrack_helper
>
> nf_conntrack_ftp is not disabled by default.
> What has been disabled by default in recent kernels is the automatic
> assignment of all conntrack helpers to connections.
`lsmod | grep nf_conntrack_ftp` shows it not installed on my machine.
I am using Fedora 28. What are yo using?
>
> Automatic assignment can also be enabled when the module is loaded with
> the option nf_conntrack_helper=1.
Not on mine. I have to turn it on.
> But be aware that enabling automatic helper assignment is discouraged
> (hence it was disabled by default). It is recommended to use explicit
> assignment with the CT target instead.
>
> On a client :
> iptables -t raw -A OUTPUT -p tcp --dport 21 -j CT --helper ftp
Never got this to work.
> On a server or router
> iptables -t raw -A PREROUTING -p tcp --dport 21 -j CT --helper ftp
>
>> 3) in /etc/modprobe.d/iptables.conf add
>>
>> nf_conntrack_ftp ports=21
>
> Syntax error. You must prepend "options" to the line.
>
> Port 21 is already the default, so you do not have to specify it.
Googling it told me otherwise.
Got no error massages about the syntax.
What is the proper syntax (write it out).
>
>> 4) restart iptables
>> # systemctl restart iptables
>>
>> Note: you also have to reload your firewall rules after this too.
>
> No you don't need to reload the ruleset, unless you changed it (e.g. you
> added CT rules). Just loading helper modules and enabling automatic
> helper assignment does not require to reload iptables rules.
>
>> Sample passive and active ftp rules:
> (...)
>> Active:
>>
>> $tbls -A dsl-out -o $eth1 -p tcp -s $eth1_addr --sport
>> $allports --dport ftp-data -m state --state ESTABLISHED -j ACCEPT
>> $tbls -A dsl-in -i $eth1 -p tcp --sport ftp-data -d $eth1_addr
>> --dport $unassgn -m state --state RELATED,ESTABLISHED -j ACCEPT
>
> Can you explain why do specify different dynamic port ranges $allports
> and $unassgn ?
>
>> $tbls -A dsl-for -i $eth1 -p tcp --sport ftp-data -d
>> $internal_net --dport $unassgn -m state --state RELATED,ESTABLISHED
>> -j ACCEPT
>
> The rule accepting packets in the other direction is missing.
It is covered in the passive rules and not duplicated om purpose.
>> Passive:
>>
>> $tbls -A dsl-out -o $eth1 -p tcp -s $eth1_addr --sport $unassgn
>> --dport ftp -m conntrack --ctstate NEW,ESTABLISHED
>> -j ACCEPT
>> $tbls -A dsl-in -i $eth1 -p tcp ! --syn --sport ftp -d $eth1_addr
>> --dport $unassgn -m conntrack --ctstate RELATED,ESTABLISHED -j
>> ACCEPT
>> $tbls -A dsl-for -i $eth1 -p tcp ! --syn --sport ftp -d
>> $internal_net --dport $unassgn -m conntrack --ctstate
>> RELATED,ESTABLISHED -j ACCEPT
>
> These rules allowing FTP control connections are not specific to passive
> mode. They are also used in active mode.
On purpose, I have to support both
>
> The RELATED state should not be used in control connection rules. It
> applies to data connections (replacing NEW), not control connections.
Doesn't work without it.
>> $tbls -A dsl-out -o $eth1 -p tcp -s $eth1_addr -d $ANY_IP -m
>> helper --helper ftp -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
>
>> $tbls -A dsl-in -i $eth1 -p tcp ! --syn -s $ANY_IP -d $eth1_addr
>> -m helper --helper ftp -m conntrack --ctstate RELATED,ESTABLISHED -j
>> ACCEPT
>> $tbls -A dsl-for -i $eth1 -p tcp ! --syn -s $ANY_IP -d
>> $internal_net -m helper --helper ftp -m conntrack --ctstate
>> RELATED,ESTABLISHED -j ACCEPT
>
> On client side, the last two rules should not use the RELATED state (so
> the helper match is useless).
I don't get that last comment. It is the "--ctstate" where
these are called out, not the general "state".
Thank you for the help.
-T
Back to comp.os.linux.networking | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-24 15:39 -0700
Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-24 16:11 -0700
Re: Need help with iptables and ftp Jorgen Grahn <grahn+nntp@snipabacken.se> - 2018-08-25 07:23 +0000
Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-25 23:13 -0700
Re: Need help with iptables and ftp Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-08-26 11:35 +0200
Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-26 14:05 -0700
Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-27 00:02 +0000
Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-26 17:11 -0700
Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-27 02:00 +0000
Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-26 19:37 -0700
Re: Need help with iptables and ftp "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2018-08-26 22:59 -0400
Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-26 20:42 -0700
Re: Need help with iptables and ftp "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2018-08-27 00:29 -0400
Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-26 22:06 -0700
Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-27 09:47 +0000
Re: Need help with iptables and ftp Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-03 20:47 +0200
Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-27 09:44 +0000
Re: Need help with iptables and ftp "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2018-08-27 06:17 -0400
Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-27 12:21 -0700
Re: Need help with iptables and ftp Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-03 20:55 +0200
Re: Need help with iptables and ftp Scott Hemphill <hemphill@hemphills.net> - 2018-08-27 11:22 -0400
Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-27 12:18 -0700
Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-26 17:44 -0700
Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-26 17:43 -0700
Re: Need help with iptables and ftp Dan Purgert <dan@djph.net> - 2018-08-28 11:28 +0000
Re: Need help with iptables and ftp Jorgen Grahn <grahn+nntp@snipabacken.se> - 2018-08-29 05:38 +0000
Re: Need help with iptables and ftp Tauno Voipio <tauno.voipio@notused.fi.invalid> - 2018-08-29 10:13 +0300
Re: Need help with iptables and ftp Dan Purgert <dan@djph.net> - 2018-08-29 09:52 +0000
Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-29 12:13 +0000
Re: Need help with iptables and ftp Dan Purgert <dan@djph.net> - 2018-08-29 12:27 +0000
Re: Need help with iptables and ftp "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2018-08-29 11:14 -0400
Re: Need help with iptables and ftp Aragorn <thorongil@telenet.be> - 2018-08-29 23:15 +0200
Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-08-30 10:35 +0200
Re: Need help with iptables and ftp Jorgen Grahn <grahn+nntp@snipabacken.se> - 2018-08-30 13:16 +0000
Re: Need help with iptables and ftp Richard Kettlewell <invalid@invalid.invalid> - 2018-08-30 16:15 +0100
Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-08-30 18:42 +0200
Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-31 00:31 +0000
Re: Need help with iptables and ftp Jorgen Grahn <grahn+nntp@snipabacken.se> - 2018-08-31 05:49 +0000
Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-08-31 12:48 +0200
Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-31 22:11 +0000
Re: Need help with iptables and ftp Tauno Voipio <tauno.voipio@notused.fi.invalid> - 2018-09-01 09:56 +0300
Re: Need help with iptables and ftp Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-01 16:14 +0200
Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-09-04 18:00 +0200
Re: Need help with iptables and ftp Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-04 20:36 +0200
Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-09-05 10:25 +0200
Re: Need help with iptables and ftp Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-05 20:30 +0200
Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-09-06 00:03 +0200
Re: Need help with iptables and ftp Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-01 15:56 +0200
Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-09-01 19:18 +0000
Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-09-04 18:01 +0200
Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-31 00:25 +0000
Re: Need help with iptables and ftp "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2018-08-30 20:34 -0400
Re: Need help with iptables and ftp Dan Purgert <dan@djph.net> - 2018-08-31 09:25 +0000
Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-08-31 12:50 +0200
Re: Need help with iptables and ftp Dan Purgert <dan@djph.net> - 2018-08-31 11:13 +0000
Re: Need help with iptables and ftp Allodoxaphobia <knock_yourself_out@example.net> - 2018-08-31 12:30 +0000
csiph-web