topic Re: firewall and ftp in Operating System - Linux

firewall and ftp

Ignacio Rodríguez Arrós — Mon, 22 Mar 2004 07:02:42 GMT

I want to make ftp from one of the pcÂ´s on my net, but as i have configured a firewall in linux, i canÂ´t. In the firewall ports 20 and 21 are open, but i can only set a ftp conection but not get data. With iptables line must i put in the linux firewall to permit active ftp

Re: firewall and ftp

Alexander Chuzhoy — Mon, 22 Mar 2004 08:50:24 GMT

also open 21 and 20 udp ports
you need to have in your list the open ports first and the deny rule should come after it...

Re: firewall and ftp

Steven E. Protter — Mon, 22 Mar 2004 13:18:19 GMT

-A INPUT -i eth0 -p tcp -m tcp -- dport 21 -j okay

-A INPUT -i eth0 -p tcp -m tcp -- dport 20 -j okay

in /etc/sydconfig/iptables

if the firewall is not on eth0 adjust that.

save

service iptables restart

SEP

Re: firewall and ftp

Stuart Browne — Tue, 23 Mar 2004 01:08:53 GMT

You've not detailed what sort of firewalling you're doing, whether you're NAT/Masquerading your local connections via a single 'net connection etc..

My guess is that you are.

You'll also need to insert a few new modules:

modprobe ip_nat_ftp ip_conntrack_ftp

With those two, all should be happy.

Re: firewall and ftp

Manuel Wolfshant — Tue, 23 Mar 2004 01:10:27 GMT

Actually I think it would be beter to use:

iptables -A INPUT -p tcp --dport 21 -j ACCEPT
iptables -A INPUT -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT

if still no go, include some lines for the OUTPUT chain too:
iptables -A OUTPUT -p tcp --sport 21 -j ACCEPT
iptables -A OUTPUT -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT

this would use stateful filtering and take care of both active and passive FTP.
Of course, these are just raw rules, you might wish to adjust them depending on your setup, to only allow traffic from certain machines, through certain interfaces, and so on.

Re: firewall and ftp

Ignacio Rodríguez Arrós — Tue, 23 Mar 2004 04:08:00 GMT

Thanks to all, the problem was that ip_nat_ftp wasnÂ´t load, the 10 points to Stuart Brown