3:42 a.m.
ftp client ( passive mode ) :
227 Entering Passive Mode (192,168,1,254,226,220).
connecting to 192.168.1.254:58076
- -
connecting to 192.168.1.254:58076
! Connection failed 192.168.1.254 - connection timed out
! connect: error 0
PORT 192,168,1,101,17,247
200 PORT command successful
LIST
150 Opening ASCII mode data connection for file list
Received 61 bytes in 0.1 secs, (6100.00 bps), transfer succeeded
226 Transfer complete
-------- Original Message --------
Subject: Firewall ( iptables ) enabled for ftp ( active mode & passive
mode ) problem
Date: Sat, 27 Mar 2010 16:39:01 +0800
From: Edward. S. P. Leong <edwardspl(a)ita.org.mo>
To: fedora-list(a)redhat.com <fedora-list(a)redhat.com>,
proftp-user(a)lists.sourceforge.net
Dear All,
Mine is FC11 OS...
So, how can we enable the firewall ( iptables ) for using ftp ( active
mode & passive mode ) service ?
For the existing setting :
iptables -F
iptables -X
iptables -F -t nat
iptables -X -t nat
iptables -F -t mangle
iptables -X -t mangle
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -t nat -P OUTPUT ACCEPT
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t mangle -P PREROUTING ACCEPT
iptables -t mangle -P POSTROUTING ACCEPT
iptables -t mangle -P INPUT ACCEPT
iptables -t mangle -P OUTPUT ACCEPT
iptables -t mangle -P FORWARD ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
int="eth1"
int_add="192.168.1.254"
int_src="192.168.1.0/24"
# Only allow users to use port 22 ( ssh services ) :
iptables -A INPUT -i $int -p tcp --dport 22 -s $int_src -d $int_add -j
ACCEPT
# Only allow users to use port 20 & 21 ( ftp services ) :
iptables -A INPUT -i $int -p tcp --dport 20 -s $int_src -d $int_add -j
ACCEPT
iptables -A INPUT -i $int -p tcp --dport 21 -s $int_src -d $int_add -j
ACCEPT
# ping ( ICMP )
iptables -A INPUT -i $int -p icmp --icmp-type echo-request -s $int_src
-d $int_add -j ACCEPT
Problem of ftp client :
connection timenout
Thanks !
Edward.
9:31 a.m.
New subject: [Fwd: Firewall ( iptables ) enabled for ftp ( active mode & passive mode ) problem]
please, load nf_conntrack_ftp module (modprobe nf_conntrack_ftp)
your original iptables rules looks good
ip_conntrack is compiled into kernel already
jkk
--
W dniu 2010-03-27 13:04, Edward. S. P. Leong napisa?/?a:
Hello,
[root@host1 ~]# lsmod|grep ftp
[root@host1 ~]#
Output is nothing
And:
[root@host1 ~]# iptables -A INPUT -i eth1 -m nf_conntrack_ftp -p tcp
--dport 21 -d 192.168.1.254 -j ACCEPT
iptables v1.4.3.1: Couldn't load match
`nf_conntrack_ftp':/lib/xtables/libipt_nf_conntrack_ftp.so: cannot
open shared object file: No such file or directory
Try `iptables -h' or 'iptables --help' for more information.
[root@host1 ~]#
No of the modules can't be loaded...
Any other help ?
Thanks !
jkk(a)csk.umed.lodz.pl wrote:
> What is output from command:
> lsmod|grep ftp
>
> module nf_conntrack_ftp is a must for passive mode
>
> Dnia 27 Marca 2010, 09:42, So, Edward. S. P. Leong napisa?(a):
>
>> ftp client ( passive mode ) :
>> 227 Entering Passive Mode (192,168,1,254,226,220).
>> connecting to 192.168.1.254:58076
>> - -
>> connecting to 192.168.1.254:58076
>> ! Connection failed 192.168.1.254 - connection timed out
>> ! connect: error 0
>> PORT 192,168,1,101,17,247
>> 200 PORT command successful
>> LIST
>> 150 Opening ASCII mode data connection for file list
>> Received 61 bytes in 0.1 secs, (6100.00 bps), transfer succeeded
>> 226 Transfer complete
>>
>> -------- Original Message --------
>> Subject: Firewall ( iptables ) enabled for ftp ( active mode& passive
>> mode ) problem
>> Date: Sat, 27 Mar 2010 16:39:01 +0800
>> From: Edward. S. P. Leong<edwardspl(a)ita.org.mo>
>> To: fedora-list(a)redhat.com <fedora-list(a)redhat.com>,
>> proftp-user(a)lists.sourceforge.net
>>
>>
>>
>> Dear All,
>>
>> Mine is FC11 OS...
>> So, how can we enable the firewall ( iptables ) for using ftp ( active
>> mode& passive mode ) service ?
>>
>> For the existing setting :
>> iptables -F
>> iptables -X
>> iptables -F -t nat
>> iptables -X -t nat
>> iptables -F -t mangle
>> iptables -X -t mangle
>>
>> iptables -P INPUT DROP
>> iptables -P OUTPUT ACCEPT
>> iptables -P FORWARD ACCEPT
>> iptables -t nat -P OUTPUT ACCEPT
>> iptables -t nat -P PREROUTING ACCEPT
>> iptables -t nat -P POSTROUTING ACCEPT
>> iptables -t mangle -P PREROUTING ACCEPT
>> iptables -t mangle -P POSTROUTING ACCEPT
>> iptables -t mangle -P INPUT ACCEPT
>> iptables -t mangle -P OUTPUT ACCEPT
>> iptables -t mangle -P FORWARD ACCEPT
>>
>> iptables -A INPUT -i lo -j ACCEPT
>> iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
>>
>> int="eth1"
>> int_add="192.168.1.254"
>> int_src="192.168.1.0/24"
>> # Only allow users to use port 22 ( ssh services ) :
>> iptables -A INPUT -i $int -p tcp --dport 22 -s $int_src -d $int_add -j
>> ACCEPT
>> # Only allow users to use port 20& 21 ( ftp services ) :
>> iptables -A INPUT -i $int -p tcp --dport 20 -s $int_src -d $int_add -j
>> ACCEPT
>> iptables -A INPUT -i $int -p tcp --dport 21 -s $int_src -d $int_add -j
>> ACCEPT
>> # ping ( ICMP )
>> iptables -A INPUT -i $int -p icmp --icmp-type echo-request -s $int_src
>> -d $int_add -j ACCEPT
>>
>> Problem of ftp client :
>> connection timenout
>>
>> Thanks !
>>
>> Edward.
>>
>>
>> --
>> users mailing list
>> users(a)lists.fedoraproject.org
>> To unsubscribe or change subscription options:
>> https://admin.fedoraproject.org/mailman/listinfo/users
>> Guidelines:http://fedoraproject.org/wiki/Mailing_list_guidelines
>>
>>
>
>
--
*****************************************************
* jan k.kaminski, nucl.med.dept, med.univ. of lodz *
* pgpkey http://w4u.am.lodz.pl/~jkk/ *
***** BC02 E8F1 7FAE 1138 9182 F56D BC5A 4059 ******
fluctuat nec mergitur
7:04 a.m.
New subject: [Fwd: Firewall ( iptables ) enabled for ftp ( active mode & passive mode ) problem]
Hello,
[root@host1 ~]# lsmod|grep ftp
[root@host1 ~]#
Output is nothing
And:
[root@host1 ~]# iptables -A INPUT -i eth1 -m nf_conntrack_ftp -p tcp
--dport 21 -d 192.168.1.254 -j ACCEPT
iptables v1.4.3.1: Couldn't load match
`nf_conntrack_ftp':/lib/xtables/libipt_nf_conntrack_ftp.so: cannot open
shared object file: No such file or directory
Try `iptables -h' or 'iptables --help' for more information.
[root@host1 ~]#
No of the modules can't be loaded...
Any other help ?
Thanks !
jkk(a)csk.umed.lodz.pl wrote:
What is output from command:
lsmod|grep ftp
module nf_conntrack_ftp is a must for passive mode
Dnia 27 Marca 2010, 09:42, So, Edward. S. P. Leong napisa?(a):
>ftp client ( passive mode ) :
>227 Entering Passive Mode (192,168,1,254,226,220).
>connecting to 192.168.1.254:58076
>- -
>connecting to 192.168.1.254:58076
>! Connection failed 192.168.1.254 - connection timed out
>! connect: error 0
>PORT 192,168,1,101,17,247
>200 PORT command successful
>LIST
>150 Opening ASCII mode data connection for file list
>Received 61 bytes in 0.1 secs, (6100.00 bps), transfer succeeded
>226 Transfer complete
>
>-------- Original Message --------
>Subject: Firewall ( iptables ) enabled for ftp ( active mode & passive
>mode ) problem
>Date: Sat, 27 Mar 2010 16:39:01 +0800
>From: Edward. S. P. Leong <edwardspl(a)ita.org.mo>
>To: fedora-list(a)redhat.com <fedora-list(a)redhat.com>,
>proftp-user(a)lists.sourceforge.net
>
>
>
>Dear All,
>
>Mine is FC11 OS...
>So, how can we enable the firewall ( iptables ) for using ftp ( active
>mode & passive mode ) service ?
>
>For the existing setting :
>iptables -F
>iptables -X
>iptables -F -t nat
>iptables -X -t nat
>iptables -F -t mangle
>iptables -X -t mangle
>
>iptables -P INPUT DROP
>iptables -P OUTPUT ACCEPT
>iptables -P FORWARD ACCEPT
>iptables -t nat -P OUTPUT ACCEPT
>iptables -t nat -P PREROUTING ACCEPT
>iptables -t nat -P POSTROUTING ACCEPT
>iptables -t mangle -P PREROUTING ACCEPT
>iptables -t mangle -P POSTROUTING ACCEPT
>iptables -t mangle -P INPUT ACCEPT
>iptables -t mangle -P OUTPUT ACCEPT
>iptables -t mangle -P FORWARD ACCEPT
>
>iptables -A INPUT -i lo -j ACCEPT
>iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
>
>int="eth1"
>int_add="192.168.1.254"
>int_src="192.168.1.0/24"
># Only allow users to use port 22 ( ssh services ) :
>iptables -A INPUT -i $int -p tcp --dport 22 -s $int_src -d $int_add -j
>ACCEPT
># Only allow users to use port 20 & 21 ( ftp services ) :
>iptables -A INPUT -i $int -p tcp --dport 20 -s $int_src -d $int_add -j
>ACCEPT
>iptables -A INPUT -i $int -p tcp --dport 21 -s $int_src -d $int_add -j
>ACCEPT
># ping ( ICMP )
>iptables -A INPUT -i $int -p icmp --icmp-type echo-request -s $int_src
>-d $int_add -j ACCEPT
>
>Problem of ftp client :
>connection timenout
>
>Thanks !
>
>Edward.
>
>
>--
>users mailing list
>users(a)lists.fedoraproject.org
>To unsubscribe or change subscription options:
>https://admin.fedoraproject.org/mailman/listinfo/users
>Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
>
>
>
10:53 a.m.
New subject: [Fwd: Firewall ( iptables ) enabled for ftp ( active mode & passive mode ) problem]
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Le 27/03/2010 13:04, Edward. S. P. Leong a écrit :
Hello,
[root@host1 ~]# lsmod|grep ftp
[root@host1 ~]#
Output is nothing
And:
[root@host1 ~]# iptables -A INPUT -i eth1 -m nf_conntrack_ftp -p tcp
--dport 21 -d 192.168.1.254 -j ACCEPT
iptables v1.4.3.1: Couldn't load match
`nf_conntrack_ftp':/lib/xtables/libipt_nf_conntrack_ftp.so: cannot open
shared object file: No such file or directory
Try `iptables -h' or 'iptables --help' for more information.
[root@host1 ~]#
No of the modules can't be loaded...
Any other help ?
/sbin/iptables -A OUTPUT -o ppp0 -p tcp --dport 21 -m state --state \
NEW,ESTABLISHED -j ACCEPT
/sbin/iptables -A INPUT -i ppp0 -p tcp --sport 21 -m state --state \
ESTABLISHED -j ACCEPT
/sbin/iptables -A OUTPUT -o ppp0 -p tcp --dport 20 -m state --state \
NEW,ESTABLISHED -j ACCEPT
/sbin/iptables -A INPUT -i ppp0 -p tcp --sport 20 -m state --state \
ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A OUTPUT -o ppp0 -p tcp --sport 1024:65535 --dport \
1024:65535 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A INPUT -i ppp0 -p tcp --sport 1024:65535 --dport \
1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT
To be adapted to your config..... (obviously you have $int instead of my
ppp0.... etc.)
- --
François Patte
UFR de mathématiques et informatique
Université Paris Descartes
45, rue des Saints Pères
F-75270 Paris Cedex 06
Tél. +33 (0)1 4286 2145
http://www.math-info.univ-paris5.fr/~patte
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkuuKeoACgkQdE6C2dhV2JUJywCcCXn7wmkE6rqHytWXVedwftii
i54AoK0ZGGZMz3aVtRLvLoDey/LLET81
=GYQx
-----END PGP SIGNATURE-----
5:01 a.m.
New subject: [Fwd: Firewall ( iptables ) enabled for ftp ( active mode & passive mode ) problem]
What is output from command:
lsmod|grep ftp
module nf_conntrack_ftp is a must for passive mode
Dnia 27 Marca 2010, 09:42, So, Edward. S. P. Leong napisał(a):
ftp client ( passive mode ) :
227 Entering Passive Mode (192,168,1,254,226,220).
connecting to 192.168.1.254:58076
- -
connecting to 192.168.1.254:58076
! Connection failed 192.168.1.254 - connection timed out
! connect: error 0
PORT 192,168,1,101,17,247
200 PORT command successful
LIST
150 Opening ASCII mode data connection for file list
Received 61 bytes in 0.1 secs, (6100.00 bps), transfer succeeded
226 Transfer complete
-------- Original Message --------
Subject: Firewall ( iptables ) enabled for ftp ( active mode & passive
mode ) problem
Date: Sat, 27 Mar 2010 16:39:01 +0800
From: Edward. S. P. Leong <edwardspl(a)ita.org.mo>
To: fedora-list(a)redhat.com <fedora-list(a)redhat.com>,
proftp-user(a)lists.sourceforge.net
Dear All,
Mine is FC11 OS...
So, how can we enable the firewall ( iptables ) for using ftp ( active
mode & passive mode ) service ?
For the existing setting :
iptables -F
iptables -X
iptables -F -t nat
iptables -X -t nat
iptables -F -t mangle
iptables -X -t mangle
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -t nat -P OUTPUT ACCEPT
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t mangle -P PREROUTING ACCEPT
iptables -t mangle -P POSTROUTING ACCEPT
iptables -t mangle -P INPUT ACCEPT
iptables -t mangle -P OUTPUT ACCEPT
iptables -t mangle -P FORWARD ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
int="eth1"
int_add="192.168.1.254"
int_src="192.168.1.0/24"
# Only allow users to use port 22 ( ssh services ) :
iptables -A INPUT -i $int -p tcp --dport 22 -s $int_src -d $int_add -j
ACCEPT
# Only allow users to use port 20 & 21 ( ftp services ) :
iptables -A INPUT -i $int -p tcp --dport 20 -s $int_src -d $int_add -j
ACCEPT
iptables -A INPUT -i $int -p tcp --dport 21 -s $int_src -d $int_add -j
ACCEPT
# ping ( ICMP )
iptables -A INPUT -i $int -p icmp --icmp-type echo-request -s $int_src
-d $int_add -j ACCEPT
Problem of ftp client :
connection timenout
Thanks !
Edward.
--
users mailing list
users(a)lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
5174
days inactive
5174
days old
4 comments
3 participants
participants (3)
-
Edward S.P. Leong -
François Patte -
jkk＠csk.umed.lodz.pl