Proftpd block IP range

C-Sniper · 01-08-2008, 08:59 AM

How would i block an IP range in Proftpd?
I would like to block say from aaa.bbb.ccc.ddd - aaa.bbb.eee.fff
I know that you put it under <Limit LOGON> but how would you type it out in a correct format?
Thanks.
I don't want to add it to Iptables becasue i still want to SSH into the server but i do not want those IPs to be able to access my FTP server.

Thanks

win32sux · 01-08-2008, 11:54 AM

Quote:

Originally Posted by C-Sniper

I don't want to add it to Iptables becasue i still want to SSH into the server but i do not want those IPs to be able to access my FTP server.

I have no experience with ProFTPD, but I thought I would mention that you can make the iptables rules apply specifically to the FTP server - so that they don't affect your SSH or anything else. Example:

Code:

iptables -I INPUT -p TCP --dport 21 \
-m iprange --src-range aaa.bbb.ccc.ddd-aaa.bbb.eee.fff -j DROP

That said, the ProFTPD site has a <Limit LOGIN> example.

C-Sniper · 01-08-2008, 02:26 PM

I think that i will probably use the iptables. this is mainly for keeping a school out of my homework share.

Thanks!

C-Sniper · 02-01-2008, 08:27 AM

Is there a more permanent solution to this? As everytime i restart i see that i have to re-add the rule into IPtables. Shoud i just toss this in rc.local then?

win32sux · 02-01-2008, 11:07 AM

If you're on Slackware use rc.firewall instead.

C-Sniper · 02-01-2008, 11:27 AM

cannot find the rc.firewall file.
slocate returned no results.

unixfool · 02-01-2008, 05:39 PM

Quote:

Originally Posted by C-Sniper

cannot find the rc.firewall file.
slocate returned no results.

You're going to have to create rc.firewall...it doesn't exist by default in Slackware, although iptables is installed by default.

C-Sniper · 02-01-2008, 05:54 PM

ok so since its an rc.* file im guessing just throw it in the rc.d folder?
well ill give it a try. Thanks for everyone's help.

win32sux · 02-01-2008, 05:57 PM

Quote:

Originally Posted by C-Sniper

ok so since its an rc.* file im guessing just throw it in the rc.d folder?

Yeah, just create it and make sure it's executable.

Code:

touch /etc/rc.d/rc.firewall
chmod 755 /etc/rc.d/rc.firewall

If all you're gonna have in it is the command from above then the contents should look like:

Code:

#!/bin/sh

iptables -A INPUT -p TCP --dport 21 \
-m iprange --src-range aaa.bbb.ccc.ddd-aaa.bbb.eee.fff -j DROP

Whether you use "-A" or "-I" is irrelevant in this case, as there are (I assume) no other rules.

C-Sniper · 02-01-2008, 07:20 PM

ok... just tried it and it works fine. Cheers to all!