Can't make ip_conntrack_ftp to work with passive ftp (CentOS)

ukoDragon · 10-29-2009, 07:52 AM

I've checked a lot of forums, and I still can't make it work.

First of all when I stop iptables everything works fine.

Now configuration:

Code:

*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
..........
-A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -i eht0 -p tcp --dport 21 -j ACCEPT
..........
COMMIT

also in /etc/sysconfig/iptables-config I have

Code:

IPTABLES_MODULES="ip_conntrack_netbios_ns ip_nat_ftp ip_conntrack_ftp"

and they load without any errors.

Can someone tell me what am I doing wrong?

Also whats the difference between next 2 statements:

Code:

-A INPUT -i eth0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Code:

-A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

win32sux · 10-29-2009, 11:38 AM

Quote:

Originally Posted by ukoDragon

-A INPUT -i eht0 -p tcp --dport 21 -j ACCEPT

Is that a typo in your post or in your config file?

ukoDragon · 10-30-2009, 07:48 AM

Sometimes I connect my laptop to this computer via eth1, and eth0 is outgoing link, so I allow everything from eth1 and only secure eth0.

But everything works except ftp.

win32sux · 10-30-2009, 08:31 AM

Quote:

Originally Posted by ukoDragon

Sometimes I connect my laptop to this computer via eth1, and eth0 is outgoing link, so I allow everything from eth1 and only secure eth0.

But everything works except ftp.

Okay, but what you posted doesn't say eth0, it says eht0 (I highlighted it in red). If that's what's in your configuration file, it would never work - which is why I'm asking you (again): where did the typo originate?

ukoDragon · 10-30-2009, 10:50 AM

Oh damn. You're right. I just haven't noticed that.
Thank you very much.

BTW: can someone tell me:

Quote:

Originally Posted by ukoDragon

Also whats the difference between next 2 statements:

Code:

-A INPUT -i eth0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Code:

-A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

win32sux · 10-30-2009, 10:55 AM

See here.