Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #4197

Re: Need help with iptables and ftp

From William Unruh <unruh@invalid.ca>
Newsgroups comp.os.linux.networking
Subject Re: Need help with iptables and ftp
Date 2018-08-27 02:00 +0000
Organization A noiseless patient Spider
Message-ID <plvm07$p7s$1@dont-email.me> (permalink)
References (2 earlier) <pltgel$qaa$1@dont-email.me> <plts91$2k58$1@saria.nerim.net> <plv4mb$ft6$1@dont-email.me> <plvf39$add$1@dont-email.me> <plvfkh$qj5$1@dont-email.me>

Show all headers | View raw

On 2018-08-27, T <T@invalid.invalid> wrote:
> On 08/26/2018 05:02 PM, William Unruh wrote:
>> On 2018-08-26, T <T@invalid.invalid> wrote:
>>> On 08/26/2018 02:35 AM, Pascal Hambourg wrote:
>>>> Le 26/08/2018 à 08:13, T a écrit :
>>>>>
>>>>> Here are my notes:
>>>>
>>>> And here are my comments.
>>>>
>>>>> How to track ftp's high port with Fedora and iptables:
>>>>>
>>>>> Problem: iptables will not automatically track ftp's high ports
>>>>> (firewalld will).
>>>>
>>>> Iptables does not track anything by itself. Netfilter's connection
>>>> tracking aka "conntrack" does. Iptables just uses the resulting state.
>>>>
>>>> There are no such "FTP high ports",
>>>
>>> http://slacksite.com/other/ftp.html#passive
>>>       From the server-side firewall's standpoint, to support passive mode
>>>
>>>       FTP the following communication channels need to be opened:
>>>       FTP server's port 21 from anywhere (Client initiates connection)
>>>       FTP server's port 21 to ports > 1023 (Server responds to client's
>>> control port)
>>>       FTP server's ports > 1023 from anywhere (Client initiates data
>>> connection to random port specified by server)
>>>       FTP server's ports > 1023 to remote ports > 1023 (Server sends ACKs
>>> (and data) to client's data port)
>>>
>>> Basically, after the connection is established, communications in
>>> passive mode switches to all high ports.
>> 
>> Yes. So? The original connection is made on port 21.
>> I am not sure why you would want iptables to control those "high ports"?
>> If you disallow port 21, ftp cannot get started.
>> And there is abosolutely no way, unless it reads the inside of the
>> packets, and even there there is not much info, for iptables to know
>> this is ftp rather than something else.
>
> 21 is allowed.
>
> I have to track these high ports as in passive mode
> the server will send you a SYN on a high port and after
> that you only communicate on high ports.

Why? Why not just all them in? There is in general nothing listening on
those ports so nothing the outside world can do can get in via those
ports. So just leave you computer open on those ports.

>
>> 
>>>
>>> This is a pain in the ass to track, so nf_conntrack_ftp was
>>> created
>> 
>> What is it you want to track? And why?
>
> Take a look here.  This is a  passive mode ftp connection
> that got bounced before I got my rules straight
>
> kernel: dsl-out Everything Else IN= OUT=eno2 SRC=192.168.xxx.yyy 
> DST=208.106.xxx.yyy LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=25991 DF 
> PROTO=TCP SPT=59698 DPT=21023 WINDOW=29200 RES=0x00 SYN URGP=0
>
> Source port      SPT=59698
> Destination port DPT=21023
>
> All high ports.  That is why you need nf_conntrack_ftp which
> keeps track of them for you.
>
> Note that it is a SYN packet
>
>
>
>
>
>

Back to comp.os.linux.networking | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-24 15:39 -0700
  Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-24 16:11 -0700
  Re: Need help with iptables and ftp Jorgen Grahn <grahn+nntp@snipabacken.se> - 2018-08-25 07:23 +0000
    Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-25 23:13 -0700
      Re: Need help with iptables and ftp Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-08-26 11:35 +0200
        Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-26 14:05 -0700
          Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-27 00:02 +0000
            Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-26 17:11 -0700
              Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-27 02:00 +0000
                Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-26 19:37 -0700
                Re: Need help with iptables and ftp "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2018-08-26 22:59 -0400
                Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-26 20:42 -0700
                Re: Need help with iptables and ftp "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2018-08-27 00:29 -0400
                Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-26 22:06 -0700
                Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-27 09:47 +0000
                Re: Need help with iptables and ftp Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-03 20:47 +0200
                Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-27 09:44 +0000
                Re: Need help with iptables and ftp "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2018-08-27 06:17 -0400
                Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-27 12:21 -0700
                Re: Need help with iptables and ftp Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-03 20:55 +0200
                Re: Need help with iptables and ftp Scott Hemphill <hemphill@hemphills.net> - 2018-08-27 11:22 -0400
                Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-27 12:18 -0700
          Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-26 17:44 -0700
      Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-26 17:43 -0700
  Re: Need help with iptables and ftp Dan Purgert <dan@djph.net> - 2018-08-28 11:28 +0000
    Re: Need help with iptables and ftp Jorgen Grahn <grahn+nntp@snipabacken.se> - 2018-08-29 05:38 +0000
      Re: Need help with iptables and ftp Tauno Voipio <tauno.voipio@notused.fi.invalid> - 2018-08-29 10:13 +0300
      Re: Need help with iptables and ftp Dan Purgert <dan@djph.net> - 2018-08-29 09:52 +0000
        Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-29 12:13 +0000
          Re: Need help with iptables and ftp Dan Purgert <dan@djph.net> - 2018-08-29 12:27 +0000
            Re: Need help with iptables and ftp "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2018-08-29 11:14 -0400
              Re: Need help with iptables and ftp Aragorn <thorongil@telenet.be> - 2018-08-29 23:15 +0200
              Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-08-30 10:35 +0200
                Re: Need help with iptables and ftp Jorgen Grahn <grahn+nntp@snipabacken.se> - 2018-08-30 13:16 +0000
                Re: Need help with iptables and ftp Richard Kettlewell <invalid@invalid.invalid> - 2018-08-30 16:15 +0100
                Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-08-30 18:42 +0200
                Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-31 00:31 +0000
                Re: Need help with iptables and ftp Jorgen Grahn <grahn+nntp@snipabacken.se> - 2018-08-31 05:49 +0000
                Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-08-31 12:48 +0200
                Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-31 22:11 +0000
                Re: Need help with iptables and ftp Tauno Voipio <tauno.voipio@notused.fi.invalid> - 2018-09-01 09:56 +0300
                Re: Need help with iptables and ftp Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-01 16:14 +0200
                Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-09-04 18:00 +0200
                Re: Need help with iptables and ftp Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-04 20:36 +0200
                Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-09-05 10:25 +0200
                Re: Need help with iptables and ftp Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-05 20:30 +0200
                Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-09-06 00:03 +0200
                Re: Need help with iptables and ftp Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-01 15:56 +0200
                Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-09-01 19:18 +0000
                Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-09-04 18:01 +0200
                Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-31 00:25 +0000
                Re: Need help with iptables and ftp "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2018-08-30 20:34 -0400
                Re: Need help with iptables and ftp Dan Purgert <dan@djph.net> - 2018-08-31 09:25 +0000
                Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-08-31 12:50 +0200
                Re: Need help with iptables and ftp Dan Purgert <dan@djph.net> - 2018-08-31 11:13 +0000
                Re: Need help with iptables and ftp Allodoxaphobia <knock_yourself_out@example.net> - 2018-08-31 12:30 +0000

csiph-web