LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 02-04-2011, 08:26 AM   #1
felix001
Member
 
Registered: Jan 2009
Posts: 101

Rep: Reputation: 15
Iptables with Proxy


Im trying to set up IPTables on a FTP Proxy.
The FTP Proxy port is 2100.

So far Ive used the following config.
Code:
IPTABLES=/sbin/iptables

$IPTABLES --flush

$IPTABLES -N LOGDROP
$IPTABLES -A LOGDROP                                                            -j LOG --log-level 6
$IPTABLES -A LOGDROP                                                            -j DROP

$IPTABLES -A INPUT  -m state --state ESTABLISHED,RELATED                  -j ACCEPT
$IPTABLES -A INPUT  -m state --state NEW -m tcp -p tcp -s [Client IP] --dport 2100 -j ACCEPT
$IPTABLES -A INPUT  -i lo                                                 -j ACCEPT
$IPTABLES -A INPUT                                                        -j LOGDROP

$IPTABLES -A OUTPUT  -m state --state ESTABLISHED,RELATED                 -j ACCEPT
$IPTABLES -A OUTPUT -m tcp -p tcp     -d [FTP Server]     --dport 21       -j ACCEPT
$IPTABLES -A OUTPUT -o lo                                                 -j ACCEPT
$IPTABLES -A OUTPUT                                                       -j LOGDROP

$IPTABLES --policy INPUT DROP
$IPTABLES --policy OUTPUT DROP
Ive added the following modules

Code:
  modprobe ip_conntrack
  modprobe ip_conntrack_ftp
  modprobe ip_conntrack_ftp ports=2100,21
Looking at the logs it appears that the data channel is being blocked on the way out of the outbound interface. From this it appears that the port 21 isnt being picked up from the ftp port mod probe.

Anyone any ideas ??
 
Old 02-04-2011, 11:29 AM   #2
furface
Member
 
Registered: Dec 2009
Posts: 40

Rep: Reputation: 1
It seems to me that the following should be INPUT and not OUTPUT since your output to the true ftp server is controlled by your proxy server.

$IPTABLES -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
 
Old 02-05-2011, 04:23 AM   #3
felix001
Member
 
Registered: Jan 2009
Posts: 101

Original Poster
Rep: Reputation: 15
I think that INPUT line you mention is fine.

The FTP connection into the proxy is working, its the ftp connection out from the proxy that iptables isnt reconising.
iptables allows the port 21 connection out but then denies the data channel when it tries to connect to the ftp server.
This is what I expected the "modprobe ip_conntrack_ftp ports=2100,21" address. From this it appears it is only doing ftp tracking for 1 port....

Last edited by felix001; 02-05-2011 at 04:25 AM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
iptables for proxy server Tuxqi Linux - Networking 4 04-19-2009 01:25 AM
Proxy and Client talk, proxy isn't returning/retrieving requests (iptables problem?) mjhvg Linux - Newbie 0 03-12-2009 02:15 AM
Help needed for proxy using iptables alexcklam Linux - Networking 1 06-15-2007 12:38 PM
iptables and proxy help thagu Linux - Networking 2 02-10-2006 08:31 AM
iptables - proxy not working varun_saa Mandriva 1 04-28-2005 04:09 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 12:33 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration