LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 01-24-2005, 07:06 AM   #1
loboautoma
LQ Newbie
 
Registered: Jan 2005
Posts: 20

Rep: Reputation: 0
Question can't connect via ftp on my lan...this is iptapbles configurations....


hi, i can't access ftp in my lan. I have 2 hosts.
1 with linux is the gateway on eth0, the other one is my personal pc connected to eth1. I configured the iptables so:

# Generated by iptables-save v1.2.9 on Mon Jan 24 11:45:26 2005
*filter
:INPUT DROP [53:5664]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [857:85837]
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp ! --tcp-option 2 -j REJECT --reject-with tcp-reset
-A INPUT -i eth0 -p tcp -m tcp --dport 21 -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --dport 21 -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --dport 22 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --dport 80 -j ACCEPT
-A INPUT -s xxxxxxxx/xxxxxxxxx -p tcp -m tcp --dport 21 --tcp-flags SYN,RST,ACK SYN -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
COMMIT
# Completed on Mon Jan 24 11:45:26 2005
# Generated by iptables-save v1.2.9 on Mon Jan 24 11:45:26 2005
*nat
:PREROUTING ACCEPT [88:5432]
:POSTROUTING ACCEPT [31:4334]
:OUTPUT ACCEPT [122:12260]
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
# Completed on Mon Jan 24 11:45:26 2005

....why the ftp is not functioning? May be i need configuring some iptables command for eth1?

Note: i'm an italian linux beginner.....thanx for any help!
 
Old 01-24-2005, 07:38 AM   #2
Demonbane
Guru
 
Registered: Aug 2003
Location: Sydney, Australia
Distribution: Gentoo
Posts: 1,796

Rep: Reputation: 47
Are you able to to login the ftp server(ie you see the welcome message ans such) but unable to establish data transfer, or you cannot connect at all?
by the way if you're running standard services on these ports you don't need to open udp port 21,22 and 80
 
Old 01-24-2005, 07:53 AM   #3
loboautoma
LQ Newbie
 
Registered: Jan 2005
Posts: 20

Original Poster
Rep: Reputation: 0
Unhappy

thanx for your time....
i have the account, username and passwd....but i can't connect....the linux does not permit the connection.....is not a problem about file trasnfert but it's about a refused ftp connection....!!! can you help me???
 
Old 01-24-2005, 07:56 AM   #4
Demonbane
Guru
 
Registered: Aug 2003
Location: Sydney, Australia
Distribution: Gentoo
Posts: 1,796

Rep: Reputation: 47
Are you able to ftp using localhost?
 
Old 01-24-2005, 08:20 AM   #5
loboautoma
LQ Newbie
 
Registered: Jan 2005
Posts: 20

Original Poster
Rep: Reputation: 0
from the linux to the web i can use the ftp....but i can't use it from my pc to the linux....
.the internal pc should be ok for any ftp connection....i conneced it to a console and it was ok...but connecting to the linux host the connection is refused......sorry for my english....
 
Old 01-24-2005, 09:09 AM   #6
loboautoma
LQ Newbie
 
Registered: Jan 2005
Posts: 20

Original Poster
Rep: Reputation: 0
Unhappy

i'm not able also to ftp from linux to the internal pc....
 
Old 01-24-2005, 09:20 AM   #7
loboautoma
LQ Newbie
 
Registered: Jan 2005
Posts: 20

Original Poster
Rep: Reputation: 0
i also proved these commands line:

iptables -A FORWARD -j REJECT
iptables -A OUTPUT -p tcp --sport 1024: --dport ftp -j ACCEPT
iptables -A OUTPUT -p tcp --sport 1024: --dport ftp-data -j ACCEPT
iptables -A OUTPUT -p tcp --sport 1024: --dport 1024: -j ACCEPT
iptables -A OUTPUT -j REJECT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

but nothing to do.....something is wrong! shure!
 
Old 01-24-2005, 09:54 AM   #8
loboautoma
LQ Newbie
 
Registered: Jan 2005
Posts: 20

Original Poster
Rep: Reputation: 0
i only need the correct pitables rules from scratch to ftp from my pc in the LAN to the linux gateway....thanx to any
 
Old 01-24-2005, 11:37 AM   #9
Chowroc
Member
 
Registered: Dec 2004
Posts: 145

Rep: Reputation: 15
In post #1, there is no rules of eth1 in chain INPUT of iptables. I think that's the problem.
 
Old 01-25-2005, 04:28 AM   #10
loboautoma
LQ Newbie
 
Registered: Jan 2005
Posts: 20

Original Poster
Rep: Reputation: 0
thanx for your time Chowroc....
i'll prove with some rule for eth1!
 
Old 01-25-2005, 05:23 AM   #11
fr_laz
Member
 
Registered: Jan 2005
Location: Cork Ireland
Distribution: Debian
Posts: 384

Rep: Reputation: 32
Hi,

If you want to attempt ftp connections THROUGH your linux box, you've got to insert rules in the FORWARD section since you did
iptables -A FORWARD -j REJECT


So before this line I'll do this (if eth0 is your ext iface & eth1 your int iface)

# These modules are for ftp connexion tracking.
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp

# TCP :
iptables -A FORWARD -i eth0 -o eth1 -p tcp -sport 20:21 -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -p tcp -dport 20:21 -m state --state NEW,ESTABLISHED -j ACCEPT

# UDP :
iptables -A FORWARD -i eth0 -o eth1 -p udp -sport 20:21 -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -p udp -dport 20:21 -m state --state NEW,ESTABLISHED -j ACCEPT

# Then the file transfer itself is done on others ports
iptables -I FORWARD -i eth0 -o eth1 -p tcp --sport 1024:65535 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
iptables -I FORWARD -i eth1 -o eth0 -p tcp --sport 1024:65535 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -I FORWARD -i eth0 -o eth1 -p udp --sport 1024:65535 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
iptables -I FORWARD -i eth1 -o eth0 -p udp --sport 1024:65535 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT

and finish with
iptables -A FORWARD -j REJEC

Hope this helps, bye...
 
Old 01-25-2005, 08:04 AM   #12
loboautoma
LQ Newbie
 
Registered: Jan 2005
Posts: 20

Original Poster
Rep: Reputation: 0
many thanx....wanderful helps.....
i'll prove that commands this evening.....they are advanced rules for my linux beginner head....

i'll tell you if all it's ok!
 
Old 02-05-2005, 09:43 AM   #13
loboautoma
LQ Newbie
 
Registered: Jan 2005
Posts: 20

Original Poster
Rep: Reputation: 0
hi! the problem is solved!
In reality there was not wrong lines with iptables but i needed only one very stupid (as me) line:

ftpd -p 21

This to activate the DARPA server process.....that is a service that listens at the port 21.....i'm sorry but i didn't know this simple thing...my distribution (mandrake 10.0), i don't know for the other ones, doesn't provide an automatic service, maybe for security reasons, and you must abiltate the correct one......

At the end for the firwall i decided to use a very good one, ideal for my configuration (eth0 inet Linux, eth1 LAN windows), found at this link:

http://www.faqs.org/docs/iptables/in...nfirewall.html

where i changed the chain INPUT for tcp packets on ports 21, commenting it to not accept ftp connection from internet.....

thanz to all, see you soon
lobohead
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
running FTP server on a LAN for folks outside of the LAN johnMG Linux - Networking 4 12-23-2006 04:10 PM
No Internet but LAN and VPN connect LAN work fine??? xavior Suse/Novell 7 11-09-2005 01:14 PM
Cant connect to my webserver and ftp server from outside LAN akudewan Linux - Networking 3 05-15-2005 02:00 PM
can't connect via ftp on my lan....this is my iptables config.... loboautoma Linux - Security 8 01-28-2005 01:14 AM
Mandrake Server,Cant FTP & cant connect on LAN Velocide Mandriva 2 04-22-2004 05:30 AM


All times are GMT -5. The time now is 03:44 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration