LinuxQuestions.org
Visit Jeremy's Blog.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 11-22-2003, 09:10 PM   #1
Stric-9
LQ Newbie
 
Registered: Nov 2003
Location: Philly
Distribution: RedHat 9
Posts: 3

Rep: Reputation: 0
Can't get to certain ftp sites through my firewall


Here is my firewall. I'm not very good at this yet so it's kind of slammed together. It's probably a complete mess.

Either way, I can't seem to get to certain ftp sites. I am, however, able to get to other ftp sites.

FWVER=0.7

echo -e "\n\nLoading simple rc.firewall version $FWVER..\n"

IPTABLES=/sbin/iptables
DEPMOD=/sbin/depmod
MODPROBE=/sbin/modprob

EXTIF="eth0"
INTIF="eth1"
echo " External Interface: $EXTIF"
echo " Internal Interface: $INTIF"

echo -en " loading modules: "

echo " - Verifying that all kernel modules are ok"
$DEPMOD -a

echo "----------------------------------------------------------------------"

echo -en "ip_tables, "
$MODPROBE ip_tables

echo -en "ip_conntrack, "
$MODPROBE ip_conntrack

echo -en "ip_conntrack_ftp, "
$MODPROBE ip_conntrack_ftp

echo -en "ip_conntrack_irc, "
$MODPROBE ip_conntrack_irc

echo -en "iptable_nat, "
$MODPROBE iptable_nat

echo -en "ip_nat_ftp, "
$MODPROBE ip_nat_ftp

echo -e "ip_nat_irc"
$MODPROBE ip_nat_irc

echo "----------------------------------------------------------------------"

echo -e " Done loading modules.\n"

echo " Enabling forwarding.."
echo "1" > /proc/sys/net/ipv4/ip_forward

echo " Enabling DynamicAddr.."
echo "1" > /proc/sys/net/ipv4/ip_dynaddr

echo " Clearing any existing rules and setting default policy.."
$IPTABLES -P INPUT ACCEPT
$IPTABLES -F INPUT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -F OUTPUT
$IPTABLES -P FORWARD ACCEPT
$IPTABLES -F FORWARD
$IPTABLES -t nat -F

echo " FWD: Allow all connections OUT and IN"
$IPTABLES -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
$IPTABLES -A FORWARD -j LOG

echo " This should take care of PASV ftp input"
$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

echo " Enabling SNAT (MASQUERADE) functionality on $EXTIF"
$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE

echo " This is the line you wrote for port forwarding."
$IPTABLES -t nat -A PREROUTING -p tcp -m multiport --dport 666 -j DNAT --to-destination 192.168.0.4
$IPTABLES -t nat -A PREROUTING -p tcp -m multiport --dport 667 -j DNAT --to-destination 192.168.0.4
$IPTABLES -t nat -A PREROUTING -p tcp -m multiport --dport 668 -j DNAT --to-destination 192.168.0.4
$IPTABLES -t nat -A PREROUTING -p tcp -m multiport --dport 669 -j DNAT --to-destination 192.168.0.4
$IPTABLES -t nat -A PREROUTING -p tcp -m multiport --dport 670 -j DNAT --to-destination 192.168.0.4
$IPTABLES -t nat -A PREROUTING -p tcp -m multiport --dport 3389 -j DNAT --to-destination 192.168.0.4
$IPTABLES -t nat -A PREROUTING -p tcp -m multiport --dport 10060 -j DNAT --to-destination 192.168.0.4
$IPTABLES -t nat -A PREROUTING -p tcp -m multiport --dport 10061 -j DNAT --to-destination 192.168.0.4
$IPTABLES -t nat -A PREROUTING -p tcp -m multiport --dport 20 -j DNAT --to-destination 192.168.0.4
$IPTABLES -t nat -A PREROUTING -p tcp -m multiport --dport 21 -j DNAT --to-destination 192.168.0.4

echo -e "\nrc.firewall-2.4 v$FWVER done.\n"

It's rc.firewall-2.4 but I edited it some.

Just incase I didn't mention, I can access this ftp from the linux box, just not any of the computers sharing the connection and I'm using flashfxp.

Thanks in advance.

Last edited by Stric-9; 11-22-2003 at 09:23 PM.
 
Old 11-23-2003, 11:39 AM   #2
JordanH
Member
 
Registered: Oct 2003
Location: Toronto, Canada
Distribution: Ubuntu, FC3, RHEL 3-4 AS Retired: SuSE 9.1 Pro, RedHat 6-9, FC1-2
Posts: 360

Rep: Reputation: 30
Quote:
#!/bin/bash
echo " Enabling forwarding.."
echo "1" > /proc/sys/net/ipv4/ip_forward

echo " Clearing any existing rules and setting default policy.."
$IPTABLES -P INPUT ACCEPT
$IPTABLES -P FORWARD ACCEPT
$IPTABLES -P OUTPUT ACCEPT

$IPTABLES -F INPUT
$IPTABLES -F OUTPUT
$IPTABLES -F FORWARD
$IPTABLES -t nat -F

echo " Enabling SNAT (MASQUERADE) functionality on $EXTIF"
$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE
[EDIT]
I had to remove my initial comments because I re-read your post and realized my mistake.

Ok... the script I have extracted in the quote above will open everything up and you should be able to access your ftp.

I'll look through this script after lunch to find the cause of your woes but in the meantime, you should check out some of the recent IPTABLES threads on this forum... they'll help you setup a more secure firewall - default policies of ACCEPT mean "come on in!!"
[/EDIT]

Last edited by JordanH; 11-23-2003 at 11:51 AM.
 
Old 11-23-2003, 12:10 PM   #3
JordanH
Member
 
Registered: Oct 2003
Location: Toronto, Canada
Distribution: Ubuntu, FC3, RHEL 3-4 AS Retired: SuSE 9.1 Pro, RedHat 6-9, FC1-2
Posts: 360

Rep: Reputation: 30
Hmm... off the top of my head, it looks like your DNAT rules may be interferring with proper communications. Is your 192.168.0.4 machine is an ftp server and an irc server? (Server, not client)

I think your DNAT'ing rules to port forward 10060/61 are the cause.

For an internal ftp server, you only need the rule
$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 21 -j DNAT --to-destination 192.168.0.4
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
virtual ftp sites naveenrajn Linux - General 2 10-08-2005 05:59 AM
FTP on Certain Sites Slow stlyz3 Linux - Networking 2 07-04-2005 11:02 PM
mozilla not browsing ftp sites kabads Linux - Software 0 09-04-2003 04:41 AM
Firewall / Network Security Test Sites mrnikeswsh Linux - Security 1 08-28-2003 04:34 PM
Multiple FTP Sites on One server suomynona007 Linux - Networking 1 08-03-2002 01:27 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 11:10 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration