Re: I need iptables ftp nat help

[ToddAndMargo <ToddAndMargo@xxxxxxxx>]

Hi All,

Disregard me previous notes (into everyone's life a
little humility must fall).

Okay, another OBSCURE obstacle to overcome:

nf_conntrack_ftp is disabled by default.  To enable it:
     # echo 1 > /proc/sys/net/netfilter/nf_conntrack_helper

-T


Here are my revised notes:

How to track ftp's high port with Fedora and iptables:

Problem: iptables will not automatically track ftp's high ports 
(firewalld will).


Note: RHEL used
   ip_conntrack_ftp,  and
   ip_nat_ftp

These have been superseded by
   nf_conntrack_ftp
   nf_conntrack_tftp
   nf_nat_ftp
   nf_nat_tftp


To set up ftp high port tracking.

1) in /etc/sysconfig/iptables-config add (under this first erase add)

     IPTABLES_MODULES="nf_conntrack_ftp nf_conntrack_tftp nf_nat_ftp 
nf_nat_tftp"


2) nf_conntrack_ftp is disabled by default.  To enable it:
     # echo 1 > /proc/sys/net/netfilter/nf_conntrack_helper


3) in /etc/modprobe.d/iptables.conf add

     nf_conntrack_ftp ports=21


4) restart iptables
     # systemctl restart iptables

   Note: you also have to reload your firewall rules after this too.


5) to check modules

     # lsmod | grep ftp


Notes:
   filters are part of the kernal and are located in
      /lib/modules/`uname -r`/kernel/net/netfilter
   to use them, remove the ".ko.xz"

   manual filter adds (disappear after a reboot):
      # modprobe nf_conntrack_ftp
      # modprobe nf_conntrack_tftp
      # modprobe nf_nat_ftp
      # modprobe nf_nat_tftp


Sample passive and active ftp rules:


tbls=/sbin/iptables

if [ "$(cat /proc/sys/net/netfilter/nf_conntrack_helper)" == "0" ]; then
   echo "echo 1 > /proc/sys/net/netfilter/nf_conntrack_helper"
   echo 1 > /proc/sys/net/netfilter/nf_conntrack_helper
fi


Active:

   $tbls -A dsl-out  -o $eth1  -p tcp  -s $eth1_addr --sport $allports 
--dport ftp-data -m state --state ESTABLISHED         -j ACCEPT
   $tbls -A dsl-in   -i $eth1  -p tcp  --sport ftp-data -d $eth1_addr 
--dport $unassgn -m state --state RELATED,ESTABLISHED  -j ACCEPT
   $tbls -A dsl-for  -i $eth1  -p tcp  --sport ftp-data -d 
$internal_net --dport $unassgn -m state --state RELATED,ESTABLISHED  -j 
ACCEPT

Passive:

$tbls -A dsl-out  -o $eth1  -p tcp  -s $eth1_addr --sport $unassgn 
--dport ftp         -m conntrack --ctstate NEW,ESTABLISHED           -j 
ACCEPT
$tbls -A dsl-in   -i $eth1  -p tcp  ! --syn --sport ftp -d $eth1_addr 
--dport $unassgn -m conntrack --ctstate RELATED,ESTABLISHED       -j ACCEPT
$tbls -A dsl-for  -i $eth1  -p tcp  ! --syn --sport ftp -d $internal_net 
 --dport $unassgn  -m conntrack --ctstate RELATED,ESTABLISHED  -j ACCEPT
$tbls -A dsl-out  -o $eth1  -p tcp  -s $eth1_addr       -d $ANY_IP 
-m helper --helper ftp -m conntrack --ctstate RELATED,ESTABLISHED  -j ACCEPT
$tbls -A dsl-in   -i $eth1  -p tcp  ! --syn  -s $ANY_IP -d $eth1_addr 
-m helper --helper ftp -m conntrack --ctstate RELATED,ESTABLISHED  -j ACCEPT
$tbls -A dsl-for  -i $eth1  -p tcp  ! --syn  -s $ANY_IP -d $internal_net 
-m helper --helper ftp -m conntrack --ctstate RELATED,ESTABLISHED  -j ACCEPT



_______________________________________________
users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx