LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 06-03-2010, 08:49 AM   #1
DD554
Member
 
Registered: May 2010
Location: Rome, Italy
Distribution: fedora, centos, debian.
Posts: 34

Rep: Reputation: 0
iptables :everything works except ftp


hi.
i set up a dmz to have a internet web server and ftp server, and ssh only from local network, so i wrote a iptables script to load during boot :

#!/bin/bash
iptables -F INPUT
iptables -F FORWARD
iptables -F OUTPUT
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP
iptables -A INPUT -p tcp --dport 21 -j ACCEPT
iptables -A INPUT -s 192.168.1.0/24 -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
#iptables -A INPUT -p tcp --dport 445 -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -s 192.168.1.0/24 -p icmp -j ACCEPT
iptables -A OUTPUT -p tcp -s 192.168.1.100 -d 192.168.1.0/24 -j ACCEPT
iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

The problem is that everything works fine ( i have the same rules for other services such as samba, nfs, mysql on another server) BUT ftp there is no way to make it work. not even locally.when i try to connect, i log in, but while listing the directory i get MLSD ... and it hangs like this for a moment, then i get error message "connection time out" , "impossible to list directory". if i turn off the iptables script no problem,ftp works fine.. but why all services work and ftp no? how do i have to modify the rules?
what is strange also is that if i set as OUTPUT policy "accept", the server seems to be offline."host unknown" error message.
I was thinking the rule INPUT is fine cause at least i can login, but the dir list is not going out, so gotta modify output rules. or state?
thanks in advance
 
Old 06-03-2010, 10:13 AM   #2
troop
Member
 
Registered: Feb 2010
Distribution: gentoo, arch, fedora, freebsd
Posts: 379

Rep: Reputation: 97
FTP server does to needing ip_conntrack_ftp loaded to function properly (namely passive mode).
just type
Code:
modprobe ip_conntrack_ftp
 
1 members found this post helpful.
Old 06-03-2010, 10:25 AM   #3
blue_print
Member
 
Registered: May 2010
Location: In world
Distribution: RHEL, CentOS, Ubuntu
Posts: 275
Blog Entries: 3

Rep: Reputation: 50
Hi, Please make sure that you have opened the passive and active FTP ports in the firewall. Refer the following link, you will get the iptables command to open passive and active FTP ports.

http://www.cyberciti.biz/faq/iptable...s-not-working/
http://www.cyberciti.biz/faq/iptables-open-ftp-port-21/

Please let me know in case you encounter any issues.
 
Old 06-03-2010, 11:02 AM   #4
Hangdog42
LQ Veteran
 
Registered: Feb 2003
Location: Maryland
Distribution: Slackware
Posts: 7,803
Blog Entries: 1

Rep: Reputation: 422Reputation: 422Reputation: 422Reputation: 422Reputation: 422
Troop's suggestion is probably easiest, but some FTP servers (like vsftpd) allow you to lock down passive ports to a specific range, which means you can open those ports in your firewall.
 
Old 06-03-2010, 11:28 AM   #5
edwardcode
Member
 
Registered: Apr 2010
Posts: 161

Rep: Reputation: 17
I think the ftp rule might have an error in it try

Code:
-A INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT
if you have redhat then I know it is

Code:
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT

instead of

Code:
iptables -A INPUT -p tcp --dport 21 -j ACCEPT
 
Old 06-03-2010, 01:26 PM   #6
Hangdog42
LQ Veteran
 
Registered: Feb 2003
Location: Maryland
Distribution: Slackware
Posts: 7,803
Blog Entries: 1

Rep: Reputation: 422Reputation: 422Reputation: 422Reputation: 422Reputation: 422
@edwardcode - Actually the original line is fine since it accepts all packets on port 21, regardless of state. The rule you're proposing causes the firewall to look at the packet state and only accept NEW packets. Since the original rule is less restrictive than the one you're proposing, the original shouldn't be a problem.

What the original firewall never does is open FTP data ports, either for passive or active FTP, and that is likely the problem. There is a nice article here explaining how FTP handles ports in both modes and understanding that is critical to getting the firewall rules right.
 
Old 06-03-2010, 03:29 PM   #7
win32sux
LQ Guru
 
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870

Rep: Reputation: 380Reputation: 380Reputation: 380Reputation: 380
Quote:
Originally Posted by troop View Post
FTP server does to needing ip_conntrack_ftp loaded to function properly (namely passive mode).
just type
Code:
modprobe ip_conntrack_ftp
I second this suggestion, as I don't see any problem with the rules as they are.
 
Old 06-04-2010, 04:18 AM   #8
DD554
Member
 
Registered: May 2010
Location: Rome, Italy
Distribution: fedora, centos, debian.
Posts: 34

Original Poster
Rep: Reputation: 0
hi all. everything is working fine now with "ip_conntrack_ftp".
thanks guys ^^
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
when I use ftp://user@ftp.blah.com it works. But when I type just ftp.blah.com says.. hunterhunter Linux - General 15 03-05-2014 09:12 AM
Strangest FTP error on RHEL5. gFTP works. RHEL4 works too. GuitsBoy Linux - Software 1 04-10-2008 08:29 AM
my new iptables firewall, everything works except for FTP kawdk Linux - Networking 2 08-01-2004 04:47 AM
IPTables and FTP - ftp on LAN adamgedde Linux - Newbie 6 10-16-2003 08:11 PM
ftp and ftp port forwarding with IPtables?? FunkFlex Linux - Security 3 04-24-2002 03:03 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 07:12 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration