LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices


Reply
  Search this Thread
Old 02-19-2008, 01:08 AM   #1
vedang
Member
 
Registered: May 2006
Posts: 89

Rep: Reputation: 15
Problem of FTP through iptables.


HI,

I have a RHEL4 server configured with squid for http and https access.

This box has eth0 ( IP 192.168.0.114 ) connected to LAN and eth1 ( ip 172.16.0.3 ) connected to ADSL Broadband router whose LAN IP is 172.16.0.1 and WAN IP is static one.

This box works as a gateway and all client machines have this only gateway to access internet. I can use everything ( http, https, SMTP and POP3 ) very well from local machine and all clients in the LAN except FTP. Because default configuration of squid allows me and client machines to browse and download data, but cannot upload.

Many of our LAN users use FTP client software to upload and download data, which doesn't work through my Linux box as I could not figure out how to handle port20 and port 21 for FTP.


Please help me for iptables to work for FTP, So that I could be able to use FTP from any client FTP software.
 
Old 02-19-2008, 01:28 AM   #2
Micro420
Senior Member
 
Registered: Aug 2003
Location: Berkeley, CA
Distribution: Mac OS X Leopard 10.6.2, Windows 2003 Server/Vista/7/XP/2000/NT/98, Ubuntux64, CentOS4.8/5.4
Posts: 2,986

Rep: Reputation: 45
what does iptables -L show?
You can try adding:
Code:
iptables -A INPUT -p tcp --dport 21 -i 123.45.67.8 -j ACCEPT
-i would be your public interface. Change it to whatever is appropriate for you, for example if you only want your private LAN to access it, then replace it with the address.

Last edited by Micro420; 02-19-2008 at 01:30 AM.
 
Old 02-19-2008, 05:01 AM   #3
vedang
Member
 
Registered: May 2006
Posts: 89

Original Poster
Rep: Reputation: 15
ftp problem through iptables

The comand you gave doesn't work.

I tried to ftp using ACE ftp software on 192.168.0.66 machine and watched the activity on Linux ( 192.168.0.114 internal interface of gateway ) gateway with iptables on it with the help of iptraf command.

The FTP request arrives on eth0 interface and immediately it is RESET.


Is there any other way to achieve the same thing.

iptables -L shows following

target prot opt source destination
ACCEPT tcp --- anywhere anywhere tcp dpt:ftp
 
Old 02-26-2008, 02:07 PM   #4
rchsysdb
LQ Newbie
 
Registered: Nov 2007
Location: Melbourne, Australia
Distribution: RedHat 4 & 5
Posts: 4

Rep: Reputation: 0
Hi Vedang,

There are two iptables entries that are required. The command you have entered will allow the initial ftp connection to IP port 21, but once this connection is established ftp will then pass control to another random IP port. The problem is that the secondary random port is being blocked.

To allow ftp traffic you need to activate connection tracking, then add the rules to iptables (I've assumed there are no iptables ftp rules):

1. enable ftp connection tracking:
edit /etc/sysconfig/iptables-config
modify IPTABLES_MODULES to include ip_conntrack_ftp
(ie, IPTABLES_MODULES="ip_conntrack_ftp")

2. add iptables rules:
iptables -A INPUT -p tcp --dport 21 -j ACCEPT
iptables -A INPUT -m state --state ESTABLISH,RELATED -j ACCEPT

I done this a couple of times and it worked for me.

Hope it helps.

Mal
 
Old 02-27-2008, 12:25 AM   #5
vedang
Member
 
Registered: May 2006
Posts: 89

Original Poster
Rep: Reputation: 15
Problem of FTP through iptables.

Hi rchsysdb,

Thanks

I have tried with the commands given by you for FTP to work through iptables.
But there is strange problem.
I am using ACE ftp software. Before using commands given by you it was not even connecting to gateway machine.
But now it tries to connect and after few seconds it comes out with a message

421 proxy tried to loop, Closing connection
Failed to connect to firewall.


Now i am looking to solve this problem.

Can you help me to get it solved?
 
Old 02-28-2008, 06:18 PM   #6
rchsysdb
LQ Newbie
 
Registered: Nov 2007
Location: Melbourne, Australia
Distribution: RedHat 4 & 5
Posts: 4

Rep: Reputation: 0
Hi Vedang,

OK, let's try to work this one out..

If you could do the following for me:

1. In separate terminal windows (it's just easier):
tail -f /var/log/messages > /tmp/messages.ftp_problem
tail -f /var/log/secure > /tmp/secure.ftp_problem

2. While both the "tail -f" are running attempt to connect to the ftp server.

3. post the contents of /tmp/messages.ftp_problem, /tmp/messages.ftp_problem, capture of your ftp session, output of "iptables -L".

Then we'll see what we can find.


Thanks,
Mal
 
Old 02-29-2008, 06:34 AM   #7
vedang
Member
 
Registered: May 2006
Posts: 89

Original Poster
Rep: Reputation: 15
Smile Problem of FTP through iptables solved.

Hi rchsysdb,

Thanks friend.
Finally the rule set given by you worked.

Actually my FTP client was wrongly configured. I adjusted the FTP
client settings and it worked.
Many many thanks.

But I need to learn iptables in detail, Can you suggest any book or
any document on the net for that.

If you do not mind can i have your mail id so that i can contact you for any problem regarding linux, iptables and other.

And yes I would like to share my knowledge also. If you have any queries and if it is possible for me to provide you a solution, I will definitely do that.
 
Old 03-05-2008, 04:16 PM   #8
rchsysdb
LQ Newbie
 
Registered: Nov 2007
Location: Melbourne, Australia
Distribution: RedHat 4 & 5
Posts: 4

Rep: Reputation: 0
Hi Vedang,

Glad to be of help!

I'm not sure which books are better (or not) as I haven't actually read any of them, just the training notes of when I was doing my RHCE followed by playing around and breaking it then fixing it. So really unsure which to recommend or stay away from. Maybe there are some suggestions from others in the LQ family?

As for the email address, I'm extremely wary of publishing my email address in web forums, simply to stop any possible spam from those nasty little web trawlers that might be out there. I'll find another way of getting in touch with you though..

Again, glad to be of some help..

Mal
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
iptables - problem whit lan access to apache and ftp service Ronin_tekorei Linux - Networking 5 01-17-2008 05:21 PM
iptables and ftp problem nesargha Linux - Networking 11 09-08-2006 05:28 AM
squid iptables ftp ----- > problem Ammad Linux - Networking 1 12-25-2005 04:03 PM
IPTables and FTP - ftp on LAN adamgedde Linux - Newbie 6 10-16-2003 08:11 PM
ftp and ftp port forwarding with IPtables?? FunkFlex Linux - Security 3 04-24-2002 03:03 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Server

All times are GMT -5. The time now is 08:35 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration