1. Home
  2. Networking Firewalls
  3. basic questions on iptables

basic questions on iptables

I am running Centos 4.2 and trying to protect an FTP server on localhost with iptables.

I have one remote user with predictable IP address that will be connecting.

Before getting into the proper way of proceeding I decided to allow all traffic to and from this IP address. But it doesn't work; there is trouble with the data port (can log in but cannot list contents).

Here is my file:

-------------------

*filter

:INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :RH-Firewall-1-INPUT - [0:0]

-A INPUT -j RH-Firewall-1-INPUT

-A FORWARD -j RH-Firewall-1-INPUT

-A RH-Firewall-1-INPUT -i lo -j ACCEPT

-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT

-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT

-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 19638 -j ACCEPT

-A INPUT -s -j ACCEPT

-A OUTPUT -d -j ACCEPT

-A OUTPUT -m state --state NEW -m tcp -p tcp --sport 25 -j ACCEPT

-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited COMMIT

-------------------

If someone can let me know why this does not work I would be very happy.

I would really like to have passive FTP traffic configured correctly. I do not like allowing all traffic from an address. I believe I have the correct modules loaded:

# modprobe -l *ftp /lib/modules/2.6.9-34.EL/kernel/net/ipv4/ipvs/ip_vs_ftp.ko /lib/modules/2.6.9-34.EL/kernel/net/ipv4/netfilter/ip_conntrack_ftp.ko /lib/modules/2.6.9-34.EL/kernel/net/ipv4/netfilter/ip_conntrack_tftp.ko /lib/modules/2.6.9-34.EL/kernel/net/ipv4/netfilter/ip_nat_ftp.ko /lib/modules/2.6.9-34.EL/kernel/net/ipv4/netfilter/ip_nat_tftp.ko

Thank you very much, Peter

Reply to
Peter
Loading thread data ...

Peter wrote in news: snipped-for-privacy@sonata.lan.papamike.ca:

'RELATED' should deal with the both the active and passive forms of ftp data. When you say it doesn't work, what actually happens? Does the ls command appear to time out, or does it come back with an error immediately?

I don't understand why you are even using the FORWARD chain below. FORWARD is used only for traffic that is traversing your firewall - i.e when your firewall is acting as a router?

What about the normal ip_conntrack etc. You need those too.

Reply to
Llanzlan Klazmon

I suggest the following changes:

  1. Remove the two -A OUTPUT lines. The policy for OUTPUT is already ACCEPT, so these do nothing.
  2. Move the -A INPUT -s -j ACCEPT line into the RH-Firewall-1-INPUT chain, thusly -A RH-Firewall-1-INPUT -s -j ACCEPT The earlier -A INPUT -j RH-Firewall-1-INPUT line is causing all input traffic to use this chain.
Reply to
Stephen Sentoff

It times out.

This is a default configuration. Does the FORWARD chain deal with internally redirected traffic (my server does that).

Yes, it's there.

I changed this rule to the one below it:

-A INPUT -s -j ACCEPT

-A RH-Firewall-1-INPUT -s -j ACCEPT

This might be why it wasn't working. My additional rule was not loaded onto the proper chain.

Peter

Reply to
Peter

Ah, ok.

I picked up on your point 2 just a little while ago.

I saved my config using iptables-save. Its ouput:

# Generated by iptables-save v1.2.11 on Thu May 18 10:03:38 2006

*filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [23:4476] :RH-Firewall-1-INPUT - [0:0]

-A INPUT -j RH-Firewall-1-INPUT

-A RH-Firewall-1-INPUT -s -j ACCEPT

-A RH-Firewall-1-INPUT -i lo -j ACCEPT

-A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT

-A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 4132 -j ACCEPT

-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT

-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT

-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 19638 -j ACCEPT

-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited COMMIT # Completed on Thu May 18 10:03:38 2006

I don't know how this cannot work unless the IP address is wrong.

Reply to
Peter

Peter wrote in news: snipped-for-privacy@sonata.lan.papamike.ca:

You could use tcpdump or ethereal to capture the actual packets. Netfilter also has a -j LOG facillity you could temporarily modify your INPUT and OUTPUT chains to basically log every packet for the duration of a test. Regarding the FORWARD chain this doc might help:

formatting link
As far as I can tell, a packet either sourced or destined to an address belonging to any of the localhost's interfaces does not get sent to the FORWARD chain.

Klazmon

Reply to
Llanzlan Klazmon

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.