Is it necessary to build ip_conntrack_ftp as a module? If you want to do ports other than 21 on 2.4, yes, on 2.6, no, you can use the append="" option in LILO. -----Original Message----- From: netfilter-admin@xxxxxxxxxxxxxxxxxxx [mailto:netfilter-admin@xxxxxxxxxxxxxxxxxxx] On Behalf Of Sagara Wijetunga Sent: Thursday, June 17, 2004 11:13 AM To: netfilter Subject: Re: Allow active and passive FTP connections --- Antony Stone <Antony@xxxxxxxxxxxxxxxxxxxx> wrote: > On Thursday 17 June 2004 1:13 pm, Piszcz, Justin > Michael wrote: > > > I think he meant, modprobe ip_conntrack_ftp and if > you are behind nat > > there is a module for that as well. > > insmod should do the job perfectly well. > > NAT is very unlikely when the rules are running on > the FTP server itself > (they're in the INPUT & OUTPUT chains). > Thanks very much for everybody's comments on this. In my Linux kernel, the "FTP protocol support" under "IP: Netfilter Configuration" is build into the kernel. Therefore, there is no ip_conntrack_ftp module to load. I use Linux kernel 2.6.5, I don't use NAT and I use iptables v1.2.10. I noticed "IP: kernel level autoconfiguration" was not set. I just build that also in to the kernel, recompiled, reinstalled the Linux kernel, rebuild all modules and rebooted the server and retried the FTP connection. But my problem is still the same. For active FTP connections it drops the following packet: Jun 17 22:51:04 svr1 kernel: OUTPUT PKT DROPPED: IN= OUT=eth0 SRC=[server IP addr] DST=[client IP addr] LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=33736 DF PROTO=TCP SPT=20 DPT=32914 WINDOW=5840 RES=0x00 SYN URGP=0 For passive FTP connections it drops the following packet: Jun 17 22:54:12 svr1 kernel: INPUT PKT DROPPED: IN=eth0 OUT= MAC=00:e0:29:34:b3:58:00:e0:29:34:bb:36:08:00 SRC=[client IP addr] DST=[server IP addr] LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=40886 DF PROTO=TCP SPT=32916 DPT=32769 WINDOW=5840 RES=0x00 SYN URGP=0 Is it necessary to build ip_conntrack_ftp as a module? Sagara __________________________________ Do you Yahoo!? New and Improved Yahoo! Mail - 100MB free storage! http://promotions.yahoo.com/new_mail
