LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Slackware
User Name
Password
Slackware This Forum is for the discussion of Slackware Linux.

Notices


Reply
  Search this Thread
Old 08-13-2019, 12:19 PM   #1
PROBLEMCHYLD
Member
 
Registered: Apr 2015
Posts: 756

Rep: Reputation: Disabled
FTP PASV Iptables secure approach....


I'm getting better at iptables and have learn how to use FTP passive and securing the port ranges so only FTP is used. I can't seem to do this for QBittorrent but I thought I would share. Only one rule

Code:
iptables -A OUTPUT -p tcp -d 188.5.xx.xxx -m multiport --dports 20,21,1024:65535 -m state --state NEW -j ACCEPT
I have checked my systems for the open ports and they are closed and only opened for the specified ip address above.
 
Old 08-13-2019, 02:34 PM   #2
ehartman
Member
 
Registered: Jul 2007
Location: Delft, The Netherlands
Distribution: Slackware
Posts: 836

Rep: Reputation: 416Reputation: 416Reputation: 416Reputation: 416Reputation: 416
Quote:
Originally Posted by PROBLEMCHYLD View Post
I can't seem to do this for QBittorrent but I thought I would share.
A BitTorrent program doesn't use FTP so needs wholly different ports to be open.
But yes, "passive" FTP only uses a single port/service: 21 (the "active" variant uses 20 too, for the returned data). Note that ftps (secure with ssl/tls) uses two different ports: 990 control and 989 for the data channel.
 
1 members found this post helpful.
Old 08-13-2019, 05:39 PM   #3
Markus Wiesner
Member
 
Registered: Mar 2016
Distribution: Slackware
Posts: 39

Rep: Reputation: 69
Quote:
Originally Posted by ehartman View Post
But yes, "passive" FTP only uses a single port/service: 21 (the "active" variant uses 20 too, for the returned data).
Both active and passive FTP use an additional connection (with dynamic ports) for data transfer, the difference is the direction: in active mode, the client (!) opens a listening port and the server initiates the data connection to this port (this is often a problem behind firewalls and/or NAT), in passive mode it's the other way around (so it's like the initial control connection on port 21).

iptables has helper modules for ftp (nf_conntrack_ftp/nf_nat_ftp) which read the port numbers from the control connection (and thereby only works for unencrypted ftp, not ftps), so you only need to allow tcp port 21 (for the initial data connection) and RELATED connections (though it's still a good idea to restrict those allowed "related" port numbers to 1024-65535).
 
1 members found this post helpful.
Old 08-13-2019, 07:05 PM   #4
PROBLEMCHYLD
Member
 
Registered: Apr 2015
Posts: 756

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by Markus Wiesner View Post
iptables has helper modules for ftp (nf_conntrack_ftp/nf_nat_ftp) which read the port numbers from the control connection (and thereby only works for unencrypted ftp, not ftps), so you only need to allow tcp port 21 (for the initial data connection) and RELATED connections (though it's still a good idea to restrict those allowed "related" port numbers to 1024-65535).
This is why I posted, I didn't need to modprobe anything, just the one rule/command. Thanks and your input has been valuable.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
unable to list directory from client to FTP server ...227 entering pasv mode !! swaggerlee Linux - Server 3 06-10-2013 02:29 AM
ftp many pasv commands? Shwick Linux - Server 1 01-05-2009 12:38 AM
how to make FTP PASV ZAMO Linux - Server 1 04-12-2007 07:36 AM
Pasv FTP Troubles carmstrong Linux - Networking 4 05-15-2004 03:09 PM
Cannot get on FTP's with networked pc pasv error - Redhat 7.2 PostDeals Linux - Networking 5 04-03-2002 05:58 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Slackware

All times are GMT -5. The time now is 08:38 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration