On 08/22/2018 03:59 PM, Rick Stevens wrote:
On 08/22/2018 03:47 PM, ToddAndMargo wrote:
Hi All,
My iptables firewall ported from RHEL won't connect to ftp sites
and throws this error (written by me years ago):
WARNING: active FTP rules have been selected but one or
more necessary modules have not been detected
In /etc/sysconfig/iptables-config, you must add ip_nat_ftp
and ip_conntrack_ftp to IPTABLES_MODULES. Delimiter is a
space. For example:
IPTABLES_MODULES=ip_nat_ftp ip_conntrack_ftp
To load changes, use:
# /etc/rc.d/init.d/iptables restart
# systemctl restart iptables
To check if modules are loaded, use
lsmod
1) is Fedora doing FTP differently in iptables?
No, but Fedora, by defaults, locks down the network a lot more
than older RHEL systems. If you're using Network Manager, you can use
it to open the FTP ports necessary on your machine. Or you can edit
the /etc/sysconfig/iptables-config file and add those modules
2) where do I find
ip_nat_ftp
ip_conntrack_ftp> now a days?
They're included in the kernel RPM. If you must know, they're
located in:
/lib/modules/`uname -r`/kernel/net/netfilter
I am finding these inserted:
# lsmod | grep ftp
nf_nat_ftp 16384 0
nf_conntrack_ftp 20480 1 nf_nat_ftp
nf_nat 36864 3
nf_nat_masquerade_ipv4,nf_nat_ftp,nf_nat_ipv4
nf_conntrack 147456 9
xt_conntrack,nf_nat_masquerade_ipv4,nf_conntrack_ipv4,nf_nat,nf_nat_ftp,ipt_MASQUERADE,nf_nat_ipv4,xt_helper,nf_conntrack_ftp
Is this adequate?
So I do not have to dnf the filters. Simpler.
# ls /lib/modules/`uname -r`/kernel/net/netfilter | grep -i ftp
nf_conntrack_ftp.ko.xz
nf_conntrack_tftp.ko.xz
nf_nat_ftp.ko.xz
nf_nat_tftp.ko.xz
And the ones I use to use (ip_nat_ftp, ip_conntrack_ftp) are
not showing up. Does Fedora even require these any more?
Here is the error I am getting from iptables:
Aug 22 16:12:09 rn6 kernel: dsl-out Everything Else IN= OUT=eno2
SRC=192.168.xxx.yyy DST=208.106.xxx.yyy LEN=60 TOS=0x00 PREC=0x00 TTL=64
ID=25991 DF PROTO=TCP SPT=59698 DPT=21023 WINDOW=29200 RES=0x00 SYN URGP=0
Which means ftp it trying to establish high ports, which is what
it is suppose to do. The problem is that I am not tracking them,
as I should. "ip_conntrack_ftp" use to do this.
What am I missing?
-T
_______________________________________________
users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx/message/XIEPKMBOM2L4LZFZUMTCFY6EHYYLBBL7/
