Hi, You are indeed right. Though I have definitely enabled FXP in my ftp server, I see iptables dropping the active connections the server makes to the remote server. The FXP client displays: PORT command ok Time-out opening connection. When I do some tcpdumping, I can see the PORT command being sent. The ftp server tries to open a connection, but packets get dropped because they're UNRELATED to the ftp connection (probably due to PORT command containing different IP then client). Now I have only a couple of people on the ftp server in my DMZ. So I could very easily configure the server to use a range of say 100 ports for active ftp connections and open them up to the outside world. It would however be much neater to have iptables connection tracking allow the fxp connections. That's why I just need a yes / no answer on the question. Any developpers here, that can tell, or should I rather contact RedHat, to ask how they compiled iptables? Thanks for the answer so far. -----Original Message----- From: netfilter-bounces@xxxxxxxxxxxxxxxxxxx [mailto:netfilter-bounces@xxxxxxxxxxxxxxxxxxx] On Behalf Of Kenneth Kalmer Sent: Wednesday, March 09, 2005 9:04 AM To: Brent Clark Cc: netfilter@xxxxxxxxxxxxxxxxxxx Subject: Re: Dynamic DNS On Wed, 09 Mar 2005 08:29:23 +0200, Brent Clark <bclark@xxxxxxxxxxxxxxxxxxxx> wrote: > Sebastian Docktor wrote: > > Hi, > > > > I want to allow a Dynamic DNS Client to Access the SSH-Server > > on my Firewall. But I don't want to open SSH for all IPs, > > Is it possible that iptables always looks up the ip address from the > > hostname, so that only the ip has access which is registrated under > > the dyndns? > > > > > > Hi > > This may be a ridiculous suggestion. > > How about basing it on MAC address. > > Stupid I know. > > Buts all I could think off. > > Brent Clark > > I'm not too sure either, but I do know that iptables resolve the names the moment the rule is added, not again. Unless you run the rule every minute to make sure it's updated constantly. Can't you setup SSHD to only allow connections from certain hosts? Then again sshd might use the reverse lookup of the ip, which isn't always the dyndns name... Will you let us know how you achieve this? -- Kenneth Kalmer kenneth.kalmer@xxxxxxxxx http://opensourcery.blogspot.com
