I'm trying to setup and ftp server which is protected with iptables and am having a few probs with PASV mode and was wondering if anyone have a sample iptables file I could have a look at.
Thanks in advance
Richard
Richard Worwood wrote:
I'm trying to setup and ftp server which is protected with iptables and am having a few probs with PASV mode and was wondering if anyone have a sample iptables file I could have a look at.
Thanks in advance
Richard
Aside from allowing tcp port 21 input, you need to accept packets of state established, related in iptables. You will also need to edit /etc/sysconfig/iptables-config, uncommenting and editing the following line for an ftp server: IPTABLES_MODULES="ip_conntrack_ftp" If it is a firewall providing nat that you are allowing access to the ftp server through, then that line needs to be: IPTABLES_MODULES="ip_conntrack_ftp ip_nat_ftp"
One or the other is probably your issue depending on your configuration.
Chris
Richard Worwood wrote:
I'm trying to setup and ftp server which is protected with iptables and am having a few probs with PASV mode and was wondering if anyone have a sample iptables file I could have a look at.
An ftp proxy like the one at http://www.mcknight.de/jftpgw/ might be worth considering.
Thanks in advance
Richard
----- Original Message ----- From: "Richard Worwood" mlists@tdbnetworks.org To: fedora-list@redhat.com Sent: Tuesday, November 02, 2004 11:52 AM Subject: IPTables for FTP
I'm trying to setup and ftp server which is protected with iptables and am having a few probs with PASV mode and was wondering if anyone have a sample iptables file I could have a look at.
Thanks in advance
Richard
I noticed that no one suggested setting the pasv_min_port and pasv_max_port in the /etc/vsftpd/vsftpd.conf and then opening the corresponding ports in iptables. Any particular reason why? I am not what I would consider proficient enough with vsftp to know whether either of the previous two answers addressed the whole issue of PASV mode.
-Eucke
Eucke Warren wrote:
I noticed that no one suggested setting the pasv_min_port and pasv_max_port in the /etc/vsftpd/vsftpd.conf and then opening the corresponding ports in iptables. Any particular reason why? I am not what I would consider proficient enough with vsftp to know whether either of the previous two answers addressed the whole issue of PASV mode.
-Eucke
The use of the iptables module for ftp connection tracking in conjunction with iptables rules to allow packets of state established,related and from anywhere to tcp port 21 dynamically enables packets for a data connection that is specified between the server and client by directives on the ftp control connection. In other words it will intelligently allow data connections that the control connection specifies. This is better than blindly opening specific or a range of ports that you constrain your ftp server to use, in that it only allows the necessary client address to access its data connection, not other clients attempting to do so.
Chris