FTP connection track

hi

i have a problem and would like to ask how you would do it. i have a linux router box. behind is my computer.
I would like to track FTP connections so I can priotize them i my QoS. what rules should be applied to my box?

Krystian

  iptables -t mangle -A PREROUTING -m helper --helper ftp \
    -j MARK --set-mark 1

queue based on that mark (or the lack thereof). setting up queuing is beyond the scope of this list. more info at:

http://lartc.org/howto/index.html

-j

Jason Opperisano <[email protected]>

Hi all,

I done this configuration test with iptables :
iptables -P INPUT DROP
iptables -A INPUT -j LOG
iptables -P OUTPUT DROP
iptables -A OUTPUT -j LOG

I done this with iptables on a mandrake and on a REDHAT.
I try to ping in 127.0.0.1 and after
On Mandrake if I do a tail -f /var/log/messages I see the DROP
On RedHat it doesn't work.

the syslog.conf on RedHat and Mandrake are:
*.info;mail.none;;news.none;authpriv.none
-/var/log/messages

What is the problem or what is the difference about default configuration between Mandrake and redHat?

Best Regards,

Yann Conan
Bordeaux,France

Vous manquez d’espace pour stocker vos mails ? Yahoo! Mail vous offre GRATUITEMENT 100 Mo ! Créez votre Yahoo! Mail sur http://fr.benefits.yahoo.com/

Le nouveau Yahoo! Messenger est arrivé ! Découvrez toutes les nouveautés pour dialoguer instantanément avec vos amis. A télécharger gratuitement sur http://fr.messenger.yahoo.com

At a guess, there's already some rules in place on the RH box, and you added your LOG rule after them. I've seen that many RH and Fedora installs create a default ruleset, even if told "no firewall" during installation!

Try "iptables -vnL" and see if there's other rules already in place, and check the packet & byte counts (first two numbers on each rule's line) to confirm if your LOG rule is actually matching packets.

If you have default rules in place (RH likes jumping to a custom chain, like 'lokkit' something) then "iptables -F" to flush rules in filter tables chains, set DROP policies, then "service iptables save" will ensure that this configuration will be restored on reboot. (if your ruleset is not overly complicated, and doesn't depend on 'current' info like dynamic IP changes, you can just save/restore your rules this way pretty damn easily) You can look at the rules that will be restored during startup this way by examining /etc/sysconfig/iptables.

Another suggestion is to insert "kern.=debug /var/log/firewall" near the top of /etc/syslog.conf (and restart syslog with "service syslog restart" or a reboot), then add "--log-level 7" to each of your LOG rules. Unless you're running a debug build of a kernel, you should get almost exclusively firewall-LOG entries in that file. Then use "--log-prefix 'SSHin:'" or whatever to aid in identifying LOG entries, where and why they were logged.

j