passive mode ftp high ports driving me nuts

DISCUSSION MargoAndTodd 2 participants 8 messages Jan 7, 2010 – Jan 9, 2010

Share & tools

MargoAndTodd

author

2010-01-07 19:13 UTC #0 lore raw

Hi All,

In my firewall, I deny all and then allow what
services though that I want. Problem: on
passive mode ftp, where the second connection is
estabilshed using random high ports, other
services are using my (last three) ftp rules.

My passive mode rules:

/etc/sysconfig/iptables-config:
IPTABLES_MODULES="ip_conntrack_netbios_ns ip_nat_ftp ip_conntrack_ftp ip_conntrack_tftp"

unassgn=1024:65535
$tbls -A dsl-out -o eth1 -p tcp -s $eth1_addr --sport $unassgn --dport ftp -m state --state NEW,ESTABLISHED -j ACCEPT

$tbls -A dsl-in -i eth1 -p tcp ! --syn --sport ftp -d $eth1_addr --dport $unassgn -m state --state RELATED,ESTABLISHED -j ACCEPT

$tbls -A dsl-for -i eth1 -p tcp ! --syn --sport ftp -d $internal_net
--dport $unassgn -m state --state RELATED,ESTABLISHED -j ACCEPT

# The "ftpdata" session is a "new" one when it sends the SYN. However, the ftp_conntrack module marks it as related to its controlling

# ftp session, so that state=related matches.  This should deny any "ftpdata" session that doesn't have a controlling ftp session.

$tbls -A dsl-out -o eth1 -p tcp -s $eth1_addr --sport $unassgn -d $ANY_IP --dport $unassgn -m state --state RELATED,ESTABLISHED
-j ACCEPT

$tbls -A dsl-in -i eth1 -p tcp ! --syn -s $ANY_IP --sport $unassgn -d $eth1_addr --dport $unassgn -m state --state RELATED,ESTABLISHED
-j ACCEPT

$tbls -A dsl-for -i eth1 -p tcp ! --syn -s $ANY_IP --sport $unassgn -d $internal_net --dport $unassgn -m state --state RELATED,ESTABLISHED
-j ACCEPT

It is the "--sport $unassgn --dport $unassgn" that is killing me. How do I restrict the last three to just passive mode ftp?

Also, what is the lowest port that the random passive mode ftp port will choose? 20,000? That may be all I need to do.

Many thanks,
-T

Mart Frauenlob

2010-01-08 10:24 UTC #1 lore raw

Quoted 37 lines · MargoAndTodd

Hi All,
In my firewall, I deny all and then allow what
services though that I want. Problem: on
passive mode ftp, where the second connection is
estabilshed using random high ports, other
services are using my (last three) ftp rules.
My passive mode rules:
/etc/sysconfig/iptables-config:
IPTABLES_MODULES="ip_conntrack_netbios_ns ip_nat_ftp ip_conntrack_ftp ip_conntrack_tftp"
unassgn=1024:65535
$tbls -A dsl-out -o eth1 -p tcp -s $eth1_addr --sport $unassgn
--dport ftp -m state --state NEW,ESTABLISHED -j ACCEPT
$tbls -A dsl-in -i eth1 -p tcp ! --syn --sport ftp -d $eth1_addr
--dport $unassgn -m state --state RELATED,ESTABLISHED -j ACCEPT
$tbls -A dsl-for -i eth1 -p tcp ! --syn --sport ftp -d $internal_net
--dport $unassgn -m state --state RELATED,ESTABLISHED -j ACCEPT
# The "ftpdata" session is a "new" one when it sends the SYN. However, the ftp_conntrack module marks it as related to its controlling
# ftp session, so that state=related matches.  This should deny any
"ftpdata" session that doesn't have a controlling ftp session.
$tbls -A dsl-out -o eth1 -p tcp -s $eth1_addr --sport $unassgn -d
$ANY_IP --dport $unassgn -m state --state RELATED,ESTABLISHED -j
ACCEPT
$tbls -A dsl-in -i eth1 -p tcp ! --syn -s $ANY_IP --sport $unassgn
(quoted diff) +0 -2
-d $eth1_addr --dport $unassgn  -m state --state RELATED,ESTABLISHED  
-j ACCEPT

Quoted 8 lines

$tbls -A dsl-for -i eth1 -p tcp ! --syn -s $ANY_IP --sport $unassgn
-d $internal_net --dport $unassgn -m state --state RELATED,ESTABLISHED
-j ACCEPT
It is the "--sport $unassgn --dport $unassgn" that is killing me. How do I restrict the last three to just passive mode ftp?

use the 'helper' match extension. i.e: -m helper --helper ftp. if you need to distinguish between active and passive, you still can use the port and state matches for that.

Quoted 2 lines

Also, what is the lowest port that the random passive mode ftp port will choose? 20,000? That may be all I need to do.

personally i never had problems using '1024:' as unassigned/unprivileged port range. but as stated before, this is obsolete and / or irrelevant. the helper match will select the appropriate packets.

Quoted 3 lines

Many thanks,
-T

regards

Mart

MargoAndTodd

author

2010-01-08 16:09 UTC #2 lore raw

Quoted 3 lines

Quoted 3 lines
It is the "--sport $unassgn --dport $unassgn" that is killing me. How do I restrict the last three to just passive mode ftp?

Quoted 3 lines · Mart Frauenlob

use the 'helper' match extension. i.e: -m helper --helper ftp. if you need to distinguish between active and passive, you still can use the port and state matches for that.

Hi Mart,

Thank you!

Can you point me to the directions/manual for the
"-m helper --helper ftp" so I can figure out what
exactly it is doing and how to install it?

Many thanks,
-T

Mart Frauenlob

2010-01-08 16:40 UTC #3 lore raw

Quoted 11 lines · MargoAndTodd

Quoted 3 lines
Quoted 3 lines
It is the "--sport $unassgn --dport $unassgn" that is killing me. How do I restrict the last three to just passive mode ftp?
Quoted 3 lines · Mart Frauenlob
use the 'helper' match extension. i.e: -m helper --helper ftp. if you need to distinguish between active and passive, you still can use the port and state matches for that.

Quoted 6 lines

Can you point me to the directions/manual for the
"-m helper --helper ftp" so I can figure out what
exactly it is doing and how to install it?
Many thanks,
-T

iptables -m helper -h

man iptables

find /lib/modules/ -name '*helper*' -exec modinfo '{}' \;

http://www.frozentux.net/iptables-tutorial/iptables-tutorial.html#HELPERMATCH

if your iptables / kernel don't have support for the helper match -> time to upgrade!?

regards

Mart

MargoAndTodd

author

2010-01-09 02:59 UTC #4 lore raw

In reply to Mart Frauenlob

Quoted 7 lines · Mart Frauenlob

Quoted 3 lines
It is the "--sport $unassgn --dport $unassgn" that is killing me. How do I restrict the last three to just passive mode ftp?
use the 'helper' match extension. i.e: -m helper --helper ftp. if you need to distinguish between active and passive, you still can use the port and state matches for that.

Hi Mart,

Works perfectly. Thank you!

-T

p.s. my new rules:

# ftp passive mode (browser) stuff.  Note: ftp_conntrack module is required, e.g.:
# /etc/sysconfig/iptables-config:
# IPTABLES_MODULES="ip_conntrack_ftp"
#
$tbls -A dsl-out  -o eth1  -p tcp  -s $eth1_addr --sport $unassgn --dport ftp         -m state --state NEW,ESTABLISHED           -j ACCEPT
$tbls -A dsl-in   -i eth1  -p tcp  ! --syn --sport ftp -d $eth1_addr --dport $unassgn -m state --state RELATED,ESTABLISHED       -j ACCEPT
$tbls -A dsl-for  -i eth1  -p tcp  ! --syn --sport ftp -d $internal_net 
 --dport $unassgn  -m state --state RELATED,ESTABLISHED  -j ACCEPT
# The "ftpdata" session is a "new" one when it sends the SYN.  However, the ftp_conntrack module marks it as related to its controlling
# ftp session, so that state=related matches.  This should deny any "ftpdata" session that doesn't have a controlling ftp session.
#$tbls -A dsl-out  -o eth1  -p tcp  -s $eth1_addr --sport $unassgn -d $ANY_IP --dport $unassgn -m state --state RELATED,ESTABLISHED 
     -j ACCEPT
#$tbls -A dsl-in   -i eth1  -p tcp  ! --syn  -s $ANY_IP --sport $unassgn -d $eth1_addr --dport $unassgn  -m state --state RELATED,ESTABLISHED 
  -j ACCEPT
#$tbls -A dsl-for  -i eth1  -p tcp  ! --syn  -s $ANY_IP --sport $unassgn -d $internal_net --dport $unassgn   -m state --state RELATED,ESTABLISHED 
 -j ACCEPT
$tbls -A dsl-out  -o eth1  -p tcp  -s $eth1_addr       -d $ANY_IP -m helper --helper ftp -m state --state RELATED,ESTABLISHED  -j ACCEPT
$tbls -A dsl-in   -i eth1  -p tcp  ! --syn  -s $ANY_IP -d $eth1_addr -m helper --helper ftp -m state --state RELATED,ESTABLISHED  -j ACCEPT
$tbls -A dsl-for  -i eth1  -p tcp  ! --syn  -s $ANY_IP -d $internal_net -m helper --helper ftp -m state --state RELATED,ESTABLISHED  -j ACCEPT

Mart Frauenlob

2010-01-09 13:55 UTC #5 lore raw

Quoted 40 lines · MargoAndTodd

Quoted 7 lines · Mart Frauenlob

Quoted 3 lines
It is the "--sport $unassgn --dport $unassgn" that is killing me. How do I restrict the last three to just passive mode ftp?
use the 'helper' match extension. i.e: -m helper --helper ftp. if you need to distinguish between active and passive, you still can use the port and state matches for that.

Hi Mart,

Works perfectly. Thank you!

-T

p.s. my new rules:

# ftp passive mode (browser) stuff.  Note: ftp_conntrack module is
required, e.g.:
# /etc/sysconfig/iptables-config:
# IPTABLES_MODULES="ip_conntrack_ftp"
#
$tbls -A dsl-out  -o eth1  -p tcp  -s $eth1_addr --sport $unassgn
--dport ftp         -m state --state NEW,ESTABLISHED           -j ACCEPT
$tbls -A dsl-in   -i eth1  -p tcp  ! --syn --sport ftp -d $eth1_addr
--dport $unassgn -m state --state RELATED,ESTABLISHED       -j ACCEPT
$tbls -A dsl-for  -i eth1  -p tcp  ! --syn --sport ftp -d $internal_net
 --dport $unassgn  -m state --state RELATED,ESTABLISHED  -j ACCEPT
# The "ftpdata" session is a "new" one when it sends the SYN.  However,
the ftp_conntrack module marks it as related to its controlling
# ftp session, so that state=related matches.  This should deny any
"ftpdata" session that doesn't have a controlling ftp session.
#$tbls -A dsl-out  -o eth1  -p tcp  -s $eth1_addr --sport $unassgn -d
$ANY_IP --dport $unassgn -m state --state RELATED,ESTABLISHED      -j
ACCEPT
#$tbls -A dsl-in   -i eth1  -p tcp  ! --syn  -s $ANY_IP --sport $unassgn

(quoted diff) +0 -2

-d $eth1_addr --dport $unassgn  -m state --state RELATED,ESTABLISHED  
-j ACCEPT

#$tbls -A dsl-for -i eth1 -p tcp ! --syn -s $ANY_IP --sport $unassgn

Quoted 9 lines

-d $internal_net --dport $unassgn -m state --state RELATED,ESTABLISHED
-j ACCEPT
$tbls -A dsl-out -o eth1 -p tcp -s $eth1_addr -d $ANY_IP -m
helper --helper ftp -m state --state RELATED,ESTABLISHED -j ACCEPT
$tbls -A dsl-in -i eth1 -p tcp ! --syn -s $ANY_IP -d $eth1_addr -m
helper --helper ftp -m state --state RELATED,ESTABLISHED -j ACCEPT $tbls -A dsl-for -i eth1 -p tcp ! --syn -s $ANY_IP -d $internal_net -m helper --helper ftp -m state --state RELATED,ESTABLISHED -j ACCEPT

if you use user-defined chains (which is good), take full advantage of it, by not repeating so many values in your ruleset. i.e. dsl-in will always have -i eth1 and -d $eth1_addr.
you don't need -d $ANY_IP, just leave it out, gives the same result. you don't need --syn, if you rely on conntrack helper match.

let me suggest a more structured approach:

# assuming DROP policy for INPUT,OUTPUT,FORWARD...

for x in dsl-in dsl-out dsl-fwd allow_ftp invalid; do

	$ipt -N $x

done

# sort out the illegal packets - could add more eventually...
$ipt -A invalid -p tcp ! --syn -m state --state NEW -j DROP
$ipt -A invalid -m state --state INVALID -j DROP

# global rules:
# allow established - speed up processing by placing rule on top
# then sort out bad ones
# allow related icmp
for x in INPUT OUTPUT FORWARD; do
	$ipt -A $x -m state ESTABLISHED -j ACCEPT
	$ipt -A $x -j invalid
	$ipt -A $x -p icmp -m state --state RELATED -j ACCEPT
done

# allow the related ftp packets
for x in dsl-in dsl-out dsl-fwd; do
	$ipt -A $x -m helper --helper ftp -j ACCEPT
done

# allow new outgoing ftp connections
$ipt -A dsl-out -p tcp --dport 21 -m state --state NEW -j ACCEPT
$ipt -A dsl-for -s $internal_net -p tcp --dport 21 -m state --state NEW
-j ACCEPT

# jump tree
$ipt -A INPUT -i eth1 -d $eth1_addr -j dsl-in
$ipt -A OUTPUT -o eth1 -s $eth1_addr -j dsl-out
$ipt -A FORWARD -i eth1 -d $internal_net -j dsl-for
$ipt -A FORWARD -o eth1 -s $internal_net -j dsl-for

as an untested example with some additional design considerations for invalid packets and related icmp.

regards

Mart

Mart Frauenlob

2010-01-09 14:04 UTC #6 lore raw

Quoted 19 lines · Mart Frauenlob

Quoted 18 lines · MargoAndTodd
Quoted 7 lines · Mart Frauenlob
Quoted 3 lines
It is the "--sport $unassgn --dport $unassgn" that is killing me. How do I restrict the last three to just passive mode ftp?
use the 'helper' match extension. i.e: -m helper --helper ftp. if you need to distinguish between active and passive, you still can use the port and state matches for that.
Hi Mart,
Works perfectly. Thank you!
-T
p.s. my new rules:

[...]

Quoted 9 lines

if you use user-defined chains (which is good), take full advantage of it, by not repeating so many values in your ruleset. i.e. dsl-in will always have -i eth1 and -d $eth1_addr.
you don't need -d $ANY_IP, just leave it out, gives the same result. you don't need --syn, if you rely on conntrack helper match.
let me suggest a more structured approach:

[...]

Quoted 4 lines

as an untested example with some additional design considerations for invalid packets and related icmp.

sorry had the naming for dsl-for and dsl-fwd mixed up, again corrected:

# assuming DROP policy for INPUT,OUTPUT,FORWARD...

for x in dsl-in dsl-out dsl-for invalid; do

	$ipt -N $x

done

# sort out the illegal packets - could add more eventually...
$ipt -A invalid -p tcp ! --syn -m state --state NEW -j DROP
$ipt -A invalid -m state --state INVALID -j DROP

# global rules:
# allow established - speed up processing by placing rule on top
# then sort out bad ones
# allow related icmp
for x in INPUT OUTPUT FORWARD; do
	$ipt -A $x -m state ESTABLISHED -j ACCEPT
	$ipt -A $x -j invalid
	$ipt -A $x -p icmp -m state --state RELATED -j ACCEPT
done

# allow the related ftp packets
for x in dsl-in dsl-out dsl-for; do
	$ipt -A $x -m helper --helper ftp -j ACCEPT
done

# allow new outgoing ftp connections
$ipt -A dsl-out -p tcp --dport 21 -m state --state NEW -j ACCEPT
$ipt -A dsl-for -s $internal_net -p tcp --dport 21 -m state --state NEW
-j ACCEPT

# jump tree
$ipt -A INPUT -i eth1 -d $eth1_addr -j dsl-in
$ipt -A OUTPUT -o eth1 -s $eth1_addr -j dsl-out
$ipt -A FORWARD -i eth1 -d $internal_net -j dsl-for
$ipt -A FORWARD -o eth1 -s $internal_net -j dsl-for

MargoAndTodd

author

2010-01-09 16:33 UTC #7 lore raw

Quoted 73 lines · Mart Frauenlob

Quoted 19 lines · Mart Frauenlob
Quoted 18 lines · MargoAndTodd
Quoted 7 lines · Mart Frauenlob
Quoted 3 lines
It is the "--sport $unassgn --dport $unassgn" that is killing me. How do I restrict the last three to just passive mode ftp?
use the 'helper' match extension. i.e: -m helper --helper ftp. if you need to distinguish between active and passive, you still can use the port and state matches for that.
Hi Mart,
Works perfectly. Thank you!
-T
p.s. my new rules:
[...]
Quoted 9 lines
if you use user-defined chains (which is good), take full advantage of it, by not repeating so many values in your ruleset. i.e. dsl-in will always have -i eth1 and -d $eth1_addr.
you don't need -d $ANY_IP, just leave it out, gives the same result. you don't need --syn, if you rely on conntrack helper match.
let me suggest a more structured approach:
[...]
Quoted 4 lines
as an untested example with some additional design considerations for invalid packets and related icmp.
sorry had the naming for dsl-for and dsl-fwd mixed up, again corrected:
# assuming DROP policy for INPUT,OUTPUT,FORWARD...
for x in dsl-in dsl-out dsl-for invalid; do
	$ipt -N $x
done
# sort out the illegal packets - could add more eventually...
$ipt -A invalid -p tcp ! --syn -m state --state NEW -j DROP
$ipt -A invalid -m state --state INVALID -j DROP
# global rules:
# allow established - speed up processing by placing rule on top
# then sort out bad ones
# allow related icmp
for x in INPUT OUTPUT FORWARD; do
	$ipt -A $x -m state ESTABLISHED -j ACCEPT
	$ipt -A $x -j invalid
	$ipt -A $x -p icmp -m state --state RELATED -j ACCEPT
done
# allow the related ftp packets
for x in dsl-in dsl-out dsl-for; do
	$ipt -A $x -m helper --helper ftp -j ACCEPT
done
# allow new outgoing ftp connections
$ipt -A dsl-out -p tcp --dport 21 -m state --state NEW -j ACCEPT
$ipt -A dsl-for -s $internal_net -p tcp --dport 21 -m state --state NEW
-j ACCEPT

Quoted 6 lines

# jump tree
$ipt -A INPUT -i eth1 -d $eth1_addr -j dsl-in
$ipt -A OUTPUT -o eth1 -s $eth1_addr -j dsl-out
$ipt -A FORWARD -i eth1 -d $internal_net -j dsl-for
$ipt -A FORWARD -o eth1 -s $internal_net -j dsl-for

Thank you!