LinuxQuestions.org
Support LQ: Use code LQ3 and save $3 on Domain Registration
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices



Reply
 
Search this Thread
Old 02-01-2005, 10:08 PM   #1
TheRealDeal
Member
 
Registered: Jun 2003
Location: Central Coast, NSW, Australia
Distribution: Gentoo
Posts: 438

Rep: Reputation: 30
FTP server stuck in passive with iptables running.


Hello.

I have a (gentoo) server that runs samba and pureftp. It runs fine when I have iptables stopped. However when I start iptables the FTP only connects in passive mode, so it won't list files or folders etc.

As soon as I turn iptables off it works fine.

Would anyone know what chain I would need to add into iptables to allow this to work properly? Below is what I used to allow ftp through my firewall...

iptables -A INPUT -i eth0 -p tcp -m multiport --dport 20,21 -j ACCEPT
iptables -A INPUT -i eth0 -p udp -m multiport --dport 20,21 -j ACCEPT

Can anyone see what I have done wrong? Thanks alot.

Best Regards,
Craig
 
Old 02-04-2005, 09:50 AM   #2
pk21
Member
 
Registered: Jun 2002
Location: Netherlands - Amsterdam
Distribution: RedHat 9
Posts: 549

Rep: Reputation: 30
active ftp works on port 21 and 20, passive ftp starts on port 21 but jumps after logging in to a port above the 1024.
So if you want your passive ftp to work when your firewall is up, you will need to use a connection tracking module. On redhat the name of the module is ip_conntrack_ftp
 
Old 02-17-2005, 07:46 PM   #3
TheRealDeal
Member
 
Registered: Jun 2003
Location: Central Coast, NSW, Australia
Distribution: Gentoo
Posts: 438

Original Poster
Rep: Reputation: 30
Hi pk.

Thanks for the info. Sorry for not replying, I haven't been getting email alerts from linuxquestions.org for some reason.

Where can I find ip_conntrack_ftp? Is this a file I can edit etc? I don't quite understand.

I would love to get this working properly.

Thanks again.
Regs
Craig
 
Old 02-18-2005, 06:05 AM   #4
pk21
Member
 
Registered: Jun 2002
Location: Netherlands - Amsterdam
Distribution: RedHat 9
Posts: 549

Rep: Reputation: 30
try the command "lsmod" to see if it is already running, if not then type "modprobe ip_conntrack_ftp".
 
Old 02-18-2005, 06:06 AM   #5
pk21
Member
 
Registered: Jun 2002
Location: Netherlands - Amsterdam
Distribution: RedHat 9
Posts: 549

Rep: Reputation: 30
(this is how it works on redhat/fedora, maybe gentoo works the same?)
 
Old 02-24-2005, 05:57 PM   #6
TheRealDeal
Member
 
Registered: Jun 2003
Location: Central Coast, NSW, Australia
Distribution: Gentoo
Posts: 438

Original Poster
Rep: Reputation: 30
works a treat.!!!! thanks PK
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
why does FTP server send local network address in passive mode? edesmarais Linux - Newbie 11 03-16-2005 01:33 AM
How do I set my FTP server to accept passive FTP? imsam Linux - Newbie 3 12-12-2004 07:22 AM
iptables and passive ftp behind NAT radix Linux - Security 7 10-21-2003 03:06 PM
IPtables and Passive FTP MatrixIII007 Linux - Security 2 10-16-2003 09:10 AM
iptables and passive FTP behind the nat radix Linux - Security 5 09-16-2003 08:14 PM


All times are GMT -5. The time now is 01:43 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration