[ILUG] iptables and FTP

[Niall O Broin]

On Fri, Mar 08, 2002 at 01:56:12PM -0000, Reilly, John wrote:

> In the filter table add the following:
> 
> # Allow ftp outbound 
> -A INPUT -i eth0 -p tcp -m tcp --sport 21 -m state --state ESTABLISHED -j
> ACCEPT
> -A OUTPUT -o eth0 -p tcp -m tcp --dport 21 -m state --state NEW,ESTABLISHED
> -j ACCEPT
> # Active ftp
> -A INPUT -p tcp -m tcp --sport 20 -m state --state RELATED,ESTABLISHED -j
> ACCEPT
> -A OUTPUT -p tcp -m tcp --dport 20 -m state --state ESTABLISHED -j ACCEPT
> # Passive ftp
> -A INPUT -p tcp -m tcp --sport 1024:65535 --dport 1024:65535 -m state
> --state ESTABLISHED -j ACCEPT
> -A OUTPUT -p tcp -m tcp --sport 1024:65535 --dport 1024:65535 -m state
> --state RELATED,ESTABLISHED -j ACCEPT
> 
> 
> The first two deal with port 21, then the following two deal with the
> ftp-data port.  Next two lines to do passive ftp.
> The above is the format understood  by iptables-restore

I entered these rules after the SuSE script had run and although I could
then ftp from the server, so the firewalling part seems correct, I still
couldn't FTP from a masqueraded client. We often talk about
lectures/discussions etc. - I would certainly find an iptables
workshop/lecture Q&A very worthwhile - any volunteers ?



Niall

P.S. Of course I know what will happen - this will get organised and then
for some reason I won't be able to go :-(