On 25.04.2010 11:09, Jan Engelhardt wrote: > On Sunday 2010-04-25 08:49, Mart Frauenlob wrote: > >> On 24.04.2010 18:48, Jeff Jensen wrote: >>> I have an email conversation from Jan 9, 2010 between >>> mart.frauenlob@xxxxxxxxx and margoandtodd@xxxxxxxxx with the subject >>> "passive mode ftp high ports driving me nuts". I have studied this >>> intensely and found out about this "helper" thing. >> you don't allow sport 21 back incoming traffic. >> btw: nf_nat_ftp is also loaded? > > That's why one should always have -m conntrack --ctstate ESTABLISHED(,RELATED) > in INPUT, FORWARD, and OUTPUT. It really trims down all these rules. > Yes, if the OP would have looked up the original post correctly it would show exactly that. http://eeek.borgchat.net/lists/netfilter/msg47205.html Putting the global RELATED rule, of course makes most of the rules obsolete (which fits in most cases), but that example was to show how to use the (ftp) helper match, if one chooses to split things up for whatever reason. Good day Mart -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
