Groups > comp.os.linux.networking > #4198

Re: Need help with iptables and ftp

From	T <T@invalid.invalid>
Newsgroups	comp.os.linux.networking
Subject	Re: Need help with iptables and ftp
Date	2018-08-26 19:37 -0700
Organization	A noiseless patient Spider
Message-ID	<plvo4t$2uh$1@dont-email.me> (permalink)
References	(3 earlier) <plts91$2k58$1@saria.nerim.net> <plv4mb$ft6$1@dont-email.me> <plvf39$add$1@dont-email.me> <plvfkh$qj5$1@dont-email.me> <plvm07$p7s$1@dont-email.me>

Show all headers | View raw

On 08/26/2018 07:00 PM, William Unruh wrote:
> On 2018-08-27, T <T@invalid.invalid> wrote:
>> On 08/26/2018 05:02 PM, William Unruh wrote:
>>> On 2018-08-26, T <T@invalid.invalid> wrote:
>>>> On 08/26/2018 02:35 AM, Pascal Hambourg wrote:
>>>>> Le 26/08/2018 à 08:13, T a écrit :
>>>>>>
>>>>>> Here are my notes:
>>>>>
>>>>> And here are my comments.
>>>>>
>>>>>> How to track ftp's high port with Fedora and iptables:
>>>>>>
>>>>>> Problem: iptables will not automatically track ftp's high ports
>>>>>> (firewalld will).
>>>>>
>>>>> Iptables does not track anything by itself. Netfilter's connection
>>>>> tracking aka "conntrack" does. Iptables just uses the resulting state.
>>>>>
>>>>> There are no such "FTP high ports",
>>>>
>>>> http://slacksite.com/other/ftp.html#passive
>>>>        From the server-side firewall's standpoint, to support passive mode
>>>>
>>>>        FTP the following communication channels need to be opened:
>>>>        FTP server's port 21 from anywhere (Client initiates connection)
>>>>        FTP server's port 21 to ports > 1023 (Server responds to client's
>>>> control port)
>>>>        FTP server's ports > 1023 from anywhere (Client initiates data
>>>> connection to random port specified by server)
>>>>        FTP server's ports > 1023 to remote ports > 1023 (Server sends ACKs
>>>> (and data) to client's data port)
>>>>
>>>> Basically, after the connection is established, communications in
>>>> passive mode switches to all high ports.
>>>
>>> Yes. So? The original connection is made on port 21.
>>> I am not sure why you would want iptables to control those "high ports"?
>>> If you disallow port 21, ftp cannot get started.
>>> And there is abosolutely no way, unless it reads the inside of the
>>> packets, and even there there is not much info, for iptables to know
>>> this is ftp rather than something else.
>>
>> 21 is allowed.
>>
>> I have to track these high ports as in passive mode
>> the server will send you a SYN on a high port and after
>> that you only communicate on high ports.
> 
> Why? Why not just all them in? There is in general nothing listening on
> those ports so nothing the outside world can do can get in via those
> ports. So just leave you computer open on those ports.

Why have a firewall at all?  The answer to that is the answer to
your question.



> 
>>
>>>
>>>>
>>>> This is a pain in the ass to track, so nf_conntrack_ftp was
>>>> created
>>>
>>> What is it you want to track? And why?
>>
>> Take a look here.  This is a  passive mode ftp connection
>> that got bounced before I got my rules straight
>>
>> kernel: dsl-out Everything Else IN= OUT=eno2 SRC=192.168.xxx.yyy
>> DST=208.106.xxx.yyy LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=25991 DF
>> PROTO=TCP SPT=59698 DPT=21023 WINDOW=29200 RES=0x00 SYN URGP=0
>>
>> Source port      SPT=59698
>> Destination port DPT=21023
>>
>> All high ports.  That is why you need nf_conntrack_ftp which
>> keeps track of them for you.
>>
>> Note that it is a SYN packet
>>
>>
>>
>>
>>
>>

Thread

Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-24 15:39 -0700
  Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-24 16:11 -0700
  Re: Need help with iptables and ftp Jorgen Grahn <grahn+nntp@snipabacken.se> - 2018-08-25 07:23 +0000
    Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-25 23:13 -0700
      Re: Need help with iptables and ftp Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-08-26 11:35 +0200
        Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-26 14:05 -0700
          Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-27 00:02 +0000
            Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-26 17:11 -0700
              Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-27 02:00 +0000
                Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-26 19:37 -0700
                Re: Need help with iptables and ftp "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2018-08-26 22:59 -0400
                Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-26 20:42 -0700
                Re: Need help with iptables and ftp "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2018-08-27 00:29 -0400
                Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-26 22:06 -0700
                Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-27 09:47 +0000
                Re: Need help with iptables and ftp Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-03 20:47 +0200
                Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-27 09:44 +0000
                Re: Need help with iptables and ftp "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2018-08-27 06:17 -0400
                Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-27 12:21 -0700
                Re: Need help with iptables and ftp Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-03 20:55 +0200
                Re: Need help with iptables and ftp Scott Hemphill <hemphill@hemphills.net> - 2018-08-27 11:22 -0400
                Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-27 12:18 -0700
          Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-26 17:44 -0700
      Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-26 17:43 -0700
  Re: Need help with iptables and ftp Dan Purgert <dan@djph.net> - 2018-08-28 11:28 +0000
    Re: Need help with iptables and ftp Jorgen Grahn <grahn+nntp@snipabacken.se> - 2018-08-29 05:38 +0000
      Re: Need help with iptables and ftp Tauno Voipio <tauno.voipio@notused.fi.invalid> - 2018-08-29 10:13 +0300
      Re: Need help with iptables and ftp Dan Purgert <dan@djph.net> - 2018-08-29 09:52 +0000
        Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-29 12:13 +0000
          Re: Need help with iptables and ftp Dan Purgert <dan@djph.net> - 2018-08-29 12:27 +0000
            Re: Need help with iptables and ftp "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2018-08-29 11:14 -0400
              Re: Need help with iptables and ftp Aragorn <thorongil@telenet.be> - 2018-08-29 23:15 +0200
              Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-08-30 10:35 +0200
                Re: Need help with iptables and ftp Jorgen Grahn <grahn+nntp@snipabacken.se> - 2018-08-30 13:16 +0000
                Re: Need help with iptables and ftp Richard Kettlewell <invalid@invalid.invalid> - 2018-08-30 16:15 +0100
                Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-08-30 18:42 +0200
                Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-31 00:31 +0000
                Re: Need help with iptables and ftp Jorgen Grahn <grahn+nntp@snipabacken.se> - 2018-08-31 05:49 +0000
                Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-08-31 12:48 +0200
                Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-31 22:11 +0000
                Re: Need help with iptables and ftp Tauno Voipio <tauno.voipio@notused.fi.invalid> - 2018-09-01 09:56 +0300
                Re: Need help with iptables and ftp Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-01 16:14 +0200
                Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-09-04 18:00 +0200
                Re: Need help with iptables and ftp Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-04 20:36 +0200
                Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-09-05 10:25 +0200
                Re: Need help with iptables and ftp Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-05 20:30 +0200
                Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-09-06 00:03 +0200
                Re: Need help with iptables and ftp Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-01 15:56 +0200
                Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-09-01 19:18 +0000
                Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-09-04 18:01 +0200
                Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-31 00:25 +0000
                Re: Need help with iptables and ftp "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2018-08-30 20:34 -0400
                Re: Need help with iptables and ftp Dan Purgert <dan@djph.net> - 2018-08-31 09:25 +0000
                Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-08-31 12:50 +0200
                Re: Need help with iptables and ftp Dan Purgert <dan@djph.net> - 2018-08-31 11:13 +0000
                Re: Need help with iptables and ftp Allodoxaphobia <knock_yourself_out@example.net> - 2018-08-31 12:30 +0000

csiph-web