[SOLVED] Have messed up my iptables? Get me to correct it !

adam1969in · 07-05-2013, 10:48 AM

I have messed up my iptables searching in Google to make ftp work on my Server. Clients get connected but unable to browse the directories nor do anything. It says ftp>Entering Passive mode and putting the message No route to host, when they hit the command "ls". I think I have messed up the iptables, many items are doubled.

I have found another way to get ftp working by enabling ip_conntrack_ftp which was not there earlier in iptables-config.

Please help me restore to the correct iptables so as to enable ftp, http and ssh.

I am using RHEL 5.4 Server X86_X64 version. I have attached the iptables file to this.

unSpawn · 07-05-2013, 11:27 AM

You messed up things so far that you're not using the chain you think you are using (INPUT -> RH-Firewall-1-INPUT) and you don't seem to grasp basics like -m state (shouldn't have NEW and ESTABLISHED in one line) and since your filter table default chains all have an "ACCEPT" policy there shouldn't be a need for that much rules. Should look something like this but you should test it (like restore backup rule set after say five minutes):

Code:

# Generated by iptables-save v1.3.5 on Fri Jul  5 12:35:05 2013
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [270:43714]
-A INPUT -i lo -j ACCEPT 
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -p tcp -m tcp -m multiport --dports 20:22,80 -m state --state NEW -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -m icmp -p icmp --icmp-type any -j ACCEPT 
-A INPUT -m udp -p udp -d 224.0.0.251 --dport 5353 -j ACCEPT 
-A INPUT -j LOG --log-prefix "REJECTED "
-A INPUT -j REJECT --reject-with icmp-host-prohibited 
-A OUTPUT -o lo -j ACCEPT
COMMIT
# Completed on Fri Jul  5 12:35:05 2013

Ser Olmy · 07-05-2013, 11:29 AM

Also, I would suggest you remove all references to TCP port 20 and use the FTP ALG module instead (modprobe nf_nat_ftp).

adam1969in · 07-05-2013, 11:32 AM

But Sir, should I add INPUT -> RH-Firewall-1-INPUT before each statement.
And many thanks for your nice reply Sir.