passive mode ftp

Hi !

I want to be able to use passive ftp under my firewall...

Right now passive mode does not function because I allow only packets WITH port 21 as a destination OR source. When in normal mode, packets from the ftp server have 21 for the source port and the packets from the client have 21 for the destination port so it works. But, entering passive mode, the destination and source ports are not 21, so my firewall blocks.

Using a ftp client such as leechftp, cuteftp, wsftp is okay, but using the browser (iexplore) does not because it use passive mode.

I don't want to open too much my ports, it would mean that someone could use those ports to get access to inside networks... But I want to be able to use passive mode, some users do not want to use ftp client software, or are not even able to install them...

Is there a specific range of ports that all passive ftp use ?

Thanks for helping me

Eric

Use Netfilter conntrack functionnalities :

# modprobe ip_conntrack_ftp

[...]

Using FTP conntrack helper, you can spot data connections with RELATED state. A setup setup could be :

	iptables -A FORWARD -m state --state ESTABLISHED,RELATED \
		-j ACCEPT
	iptables -A FORWARD -m state --state NEW -p tcp -s $LAN \
		--dport 21 -o $EXTIF -j ACCEPT

Once a FTP connection is up, further packets are handled by ESTABLISHED state rule, and connection data initiating is handled by RELATED state.

If you're using NAT, then you will need to modprobe ip_nat_ftp module.

Cédric Blancher  <[email protected]>
IT systems and networks security - Cartel Sécurité
Phone : +33 (0)1 44 06 97 87 - Fax: +33 (0)1 44 06 97 99
PGP KeyID:157E98EE  FingerPrint:FA62226DA9E72FA8AECAA240008B480E157E98EE

No, passive mode uses random ports from 1024 upwards.

You could use a web proxy like squid. You can force squid to always use active mode.

Alternatively, you could use the state inspection of iptables and the ftp connection tracking module to configure passive ftp.

http://slacksite.com/other/ftp.html

Read the article above... about active vs. passive ftp.

Also, most ftp servers allow you to specify which ports to use for passive ftp, that way you would only have to open those.

-Patrick

-----Original Message-----
From: [email protected] [mailto:[email protected]]On Behalf Of Ray Leach
Sent: Friday, May 23, 2003 6:05 AM
To: Netfilter Mailing List
Subject: Re: passive mode ftp

No, passive mode uses random ports from 1024 upwards.

You could use a web proxy like squid. You can force squid to always use active mode.

Alternatively, you could use the state inspection of iptables and the ftp connection tracking module to configure passive ftp.