[ILUG] iptables and FTP

[Niall O Broin]

I'm attempting to set up a box as a gateway for a SME and it's all fine and
dandy except for masquerading FTP. I'm using SuSE 7.3 with the SuSEfirewall2
script, which basically allows you to have a configuration file from which
it then builds the appropriate iptables commands. In that configuration file
I have 

# Every host/network may get a list of allowed services, otherwise everything
# is allowed. A target network, protocol and service is appended by a comma to
# the host/network. e.g. "10.0.0.0/8" allows the whole 10.0.0.0 network with
# unrestricted access. "10.0.1.0/24,0/0,tcp,80 10.0.1.0/24,0/0tcp,21" allows
# the 10.0.1.0 network to use www/ftp to the internet.
# "10.0.1.0/24,tcp,1024:65535 10.0.2.0/24" is OK too.
# Set this variable to "0/0" to allow unrestricted access to the internet.
#
FW_MASQ_NETS="10.0.1.0/24,0/0,tcp,80 10.0.1.0/24,0/0,tcp,21 \
10.0.1.0/24,0/0,tcp,53 10.0.1.0/24,0/0,udp,53 10.0.1.0/24,0/0,tcp,1024:65535"

I found that comment a little bit cryptic e.g. 

# unrestricted access. "10.0.1.0/24,0/0,tcp,80 10.0.1.0/24,0/0tcp,21" allows
# the 10.0.1.0 network to use www/ftp to the internet.

because I don't see where that allows for data connections except in the line

# "10.0.1.0/24,tcp,1024:65535 10.0.2.0/24" is OK too.

Now it was my understanding that iptables was a connection tracking or
stateful firewall and that thus FTP masquerading worked quite nicely, but
I'm having problems. From a 'doze client usgin command line FTP or IE5 I can
connect to an FTP server but I can't build up a data connection.

The iptables documentation is nearly silent on the matter, saying only that
NATing FTP should work if you have the ip_conntrack_ftp and ip_nat_ftp
modules loaded, which I do.

All assistance greatefully received.



Niall