pablo@xxxxxxxxxxxxx writes: > * Security: Avoid complex string matching and mangling in kernel-space > running in unprivileged mode. Or rather in privileged mode? > 2) Add rules to enable the FTP user-space helper which is > used to track traffic going to TCP port 10000. The examples use port 21 in the iptables commands and the expectations: > iptables -I OUTPUT -t raw -p tcp --dport 21 -j CT --helper ftp > iptables -I PREROUTING -t raw -p tcp --dport 21 -j CT --helper ftp > > [NEW] 301 proto=6 src=192.168.1.136 dst=130.89.148.12 sport=0 dport=54037 mask-src=255.255.255.255 mask-dst=255.255.255.255 sport=0 dport=65535 master-src=192.168.1.136 master-dst=130.89.148.12 sport=57127 dport=21 class=0 helper=ftp > [DESTROY] 301 proto=6 src=192.168.1.136 dst=130.89.148.12 sport=0 dport=54037 mask-src=255.255.255.255 mask-dst=255.255.255.255 sport=0 dport=65535 master-src=192.168.1.136 master-dst=130.89.148.12 sport=57127 dport=21 class=0 helper=ftp -- Regards, Feri. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
