Debian 2.6.8/bridge/iptables/passive ftp

Hi out there,

thanks for your replies.

@Ray
I already stumbled over http://slacksite.com/other/ftp.html and built my ruleset accordingly. As far as I understand you should be able to cater just for passive ftp.

@Arnd-Hendrik
I am not opening the high ports on the ftp server box. The (passive) ftp client sends the first request from a highport to port 21 on the server box. Have a look at the diagrams at slacksite. Which helper module do you refer to?

@Martijn
Your hint pointing to ip_conntrack_ftp lead to the solution. lsmod showed me that the module had not been loaded. After loading my ruleset worked and the clients could ftp properly.

Rebooting the bridge box left me again with an unloaded ip_conntrack_ftp. So I made an entry in /etc/modules which caters for the module to be loaded on (re)boot. Strange thing that, because other modules related to iptables are being loaded automatically, although they are not compiled into the kernel too. Are there other "surprise"-modules that have to be loaded via /etc/modules?

cu
Jo

_______________________________________________________________
SMS schreiben mit WEB.DE FreeMail - einfach, schnell und kostenguenstig. Jetzt gleich testen! http://f.web.de/?mc=021192

ip_nat_*
ip_conntrack_*

* = irc, nat, h323, etc. look into your /lib/modules dir.

Jan

All the ip_conntrack_* modules, so all the connection helpers. You could load them all, but I only load what I need.

These modules are what account for (most of the) -m state --state RELATED matches. Related in this case are all the data connections for ftp, so you don't need any rule for those data connections.

IOW to make ftp work you need:

- To load ip_conntrack_ftp
- Have a rule that allows ESTABLISHED,RELATED
- Have a rule that allows the initial SYN to port 21.

HTH,
M4

Hello,

Only modules related to iptables rules are loaded automatically, when needed by a table, target or match in a newly created rule. Conntrack and NAT helper modules for special protocols (FTP, IRC DCC, TFTP, H.323, SIP...) are not related to any rule, thus not loaded automatically.