Firewall Builder

qrange · 08-10-2017, 03:55 AM

Hi,

is there a way to make a rule in 'FirewallBuilder v5.1' so that it uses 'stateful' mode, and allows active FTP for client?

thanks.

AwesomeMachine · 08-10-2017, 05:30 AM

For active mode you must configure the ftp client to use a limited range of ports for listening. Then, you have to open those ports in the firewall. For stateful filtering, you allow the states RELATED,ESTABLISHED.

qrange · 08-10-2017, 06:11 AM

Quote:

Originally Posted by AwesomeMachine

For active mode you must configure the ftp client to use a limited range of ports for listening. Then, you have to open those ports in the firewall. For stateful filtering, you allow the states RELATED,ESTABLISHED.

thanks, how do I configure builtin command line ftp client to listen to, say, port 3333 only? what about lftp?

AwesomeMachine · 08-11-2017, 09:27 AM

I guess the Linux ftp client can't be configured that way. You'll need to allow high ports:

Code:

iptables -A INPUT -p tcp -m multiport --dports 1024:65535 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT