My notes, so no one else has to go through this crap:
How to track ftp's high port with Fedora and iptables:
Problem: iptables will not automatically track ftp's high ports
(firewalld will).
Note: RHEL used
ip_conntrack_ftp, and
ip_nat_ftp
These have been superseded by
nf_conntrack_ftp
nf_conntrack_tftp
nf_nat_ftp
nf_nat_tftp
To set up ftp high port tracking.
1) in /etc/sysconfig/iptables-config add (under this first erase add)
IPTABLES_MODULES="nf_conntrack_ftp nf_conntrack_tftp nf_nat_ftp
nf_nat_tftp"
2) in /etc/modprobe.d/iptables.conf add
nf_conntrack_ftp ports=21
3) restart iptables
# systemctl restart iptables
4) to check modules
# lsmod | grep ftp
Sample passive and active ftp rules:
tbls=/sbin/iptables
Active:
$tbls -A dsl-out -o $eth1 -p tcp -s $eth1_addr --sport $allports
--dport ftp-data -m state --state ESTABLISHED -j ACCEPT
$tbls -A dsl-in -i $eth1 -p tcp --sport ftp-data -d $eth1_addr
--dport $unassgn -m state --state RELATED,ESTABLISHED -j ACCEPT
$tbls -A dsl-for -i $eth1 -p tcp --sport ftp-data -d
$internal_net --dport $unassgn -m state --state RELATED,ESTABLISHED -j
ACCEPT
passive:
$tbls -A dsl-out -o $eth1 -p tcp -s $eth1_addr --sport $unassgn
--dport ftp -m state --state NEW,ESTABLISHED -j ACCEPT
$tbls -A dsl-in -i $eth1 -p tcp ! --syn --sport ftp -d
$eth1_addr --dport $unassgn -m state --state RELATED,ESTABLISHED
-j ACCEPT
$tbls -A dsl-for -i $eth1 -p tcp ! --syn --sport ftp -d
$internal_net --dport $unassgn -m state --state RELATED,ESTABLISHED
-j ACCEPT
$tbls -A dsl-out -o $eth1 -p tcp -s $eth1_addr -d $ANY_IP
-m helper --helper ftp -m state --state RELATED,ESTABLISHED -j ACCEPT
$tbls -A dsl-in -i $eth1 -p tcp ! --syn -s $ANY_IP -d
$eth1_addr -m helper --helper ftp -m state --state
RELATED,ESTABLISHED -j ACCEPT
$tbls -A dsl-for -i $eth1 -p tcp ! --syn -s $ANY_IP -d
$internal_net -m helper --helper ftp -m state --state
RELATED,ESTABLISHED -j ACCEPT
_______________________________________________
users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx/message/JX26PKNR2IRJIMRLJR3I2GQY2IQSOEDH/
