On 01/08/2010 02:24 AM, Mart Frauenlob wrote:
It is the "--sport $unassgn --dport $unassgn" that is killing me.
How do I restrict the last three to just passive mode ftp?
use the 'helper' match extension. i.e: -m helper --helper ftp.
if you need to distinguish between active and passive, you still can use
the port and state matches for that.
Hi Mart,
Works perfectly. Thank you!
-T
p.s. my new rules:
# ftp passive mode (browser) stuff. Note: ftp_conntrack module is
required, e.g.:
# /etc/sysconfig/iptables-config:
# IPTABLES_MODULES="ip_conntrack_ftp"
#
$tbls -A dsl-out -o eth1 -p tcp -s $eth1_addr --sport $unassgn
--dport ftp -m state --state NEW,ESTABLISHED -j ACCEPT
$tbls -A dsl-in -i eth1 -p tcp ! --syn --sport ftp -d $eth1_addr
--dport $unassgn -m state --state RELATED,ESTABLISHED -j ACCEPT
$tbls -A dsl-for -i eth1 -p tcp ! --syn --sport ftp -d $internal_net
--dport $unassgn -m state --state RELATED,ESTABLISHED -j ACCEPT
# The "ftpdata" session is a "new" one when it sends the SYN. However,
the ftp_conntrack module marks it as related to its controlling
# ftp session, so that state=related matches. This should deny any
"ftpdata" session that doesn't have a controlling ftp session.
#$tbls -A dsl-out -o eth1 -p tcp -s $eth1_addr --sport $unassgn -d
$ANY_IP --dport $unassgn -m state --state RELATED,ESTABLISHED
-j ACCEPT
#$tbls -A dsl-in -i eth1 -p tcp ! --syn -s $ANY_IP --sport $unassgn
-d $eth1_addr --dport $unassgn -m state --state RELATED,ESTABLISHED
-j ACCEPT
#$tbls -A dsl-for -i eth1 -p tcp ! --syn -s $ANY_IP --sport $unassgn
-d $internal_net --dport $unassgn -m state --state RELATED,ESTABLISHED
-j ACCEPT
$tbls -A dsl-out -o eth1 -p tcp -s $eth1_addr -d $ANY_IP
-m helper --helper ftp -m state --state RELATED,ESTABLISHED -j ACCEPT
$tbls -A dsl-in -i eth1 -p tcp ! --syn -s $ANY_IP -d $eth1_addr
-m helper --helper ftp -m state --state RELATED,ESTABLISHED -j ACCEPT
$tbls -A dsl-for -i eth1 -p tcp ! --syn -s $ANY_IP -d $internal_net
-m helper --helper ftp -m state --state RELATED,ESTABLISHED -j ACCEPT
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
