Skip to contentSkip to conversation

FTP rules

DISCUSSION [email protected] 2 participants 2 messages Jan 31, 2005

lore
Share & tools
lore

[email protected]

author
#0 lore raw

my PCs behind my firewall didn't get ftp connection to
any external ftp server. Why?

/sbin/modprobe ip_contrack
/sbin/modprobe ip_contrack_ftp

# LAN -> INTERNET
iptables -A FORWARD -i $LAN -o $INET -p tcp --dport 21 -j ACCEPT iptables -A FORWARD -i $LAN -o $INET -p tcp --dport 20 -j ACCEPT

# INTERNET ->LAN
iptables - A FORWARD -i $INET -o $LAN -p tcp -m state --state ESTABLISHED, RELATED -j ACCEPT

# NAT
iptables -t nat -A POSTROUTING -s $IPs_LAN -o $INET -j SNAT --to-source $INET_IP

Thanks fo help
_______________________________________
Connessione ed e-mail gratuita da 10 mb consultabile tramite web e tramite pop. www.infinito.it vieni a scoprire tutti i nostri servizi!

http://www.infinito.it/xmail

#1 lore raw
Quoted 6 lines · On Mon, Jan 31, 2005 at 05:40:24PM +0100, [email protected] wrote:

my PCs behind my firewall didn't get ftp connection to
any external ftp server. Why?

/sbin/modprobe ip_contrack
/sbin/modprobe ip_contrack_ftp

how about this as well:

/sbin/modprobe ip_nat_ftp

Quoted 5 lines

# LAN -> INTERNET
iptables -A FORWARD -i $LAN -o $INET -p tcp --dport 21 -j ACCEPT
iptables -A FORWARD -i $LAN -o $INET -p tcp --dport 20 -j ACCEPT

second rule is unnecessary.

Quoted 3 lines

# INTERNET ->LAN
iptables - A FORWARD -i $INET -o $LAN -p tcp -m state --state ESTABLISHED, RELATED -j ACCEPT

you need to allow ESTABLISHED,RELATED packets from LAN -> INTERNET as well, try using:

  iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

instead of your rule above.

Quoted 3 lines

# NAT
iptables -t nat -A POSTROUTING -s $IPs_LAN -o $INET -j SNAT --to-source $INET_IP

-j

--
"My cat's breath smells like cat food."
--The Simpsons