Proper detection of FTP-DATA

Proper detection of FTP-DATA

[Pieter De Wit]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset="us-ascii", Size: 641 bytes --]

Hello Guys,
 
How would you properly match FTP-DATA connections? I have tried the
following and after checking the man pages, this should work ?!?
 
iptables -A INPUT -p tcp -m tcp --dport=21 # For FTP-CTRL
iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -m state --state RELATED -j ACCEPT

Let's just say outbound is ACCEPT *
 
For passive FTP that should work, since the firewall (which is on the
FTP Server) can match that ? Or can it ?
 
Thanks,
 
Pieter
“This e-mail is sent on the Terms and Conditions that can be accessed by Clicking on this link http://www.vodacom.net/legal/email.aspx "

Re: Proper detection of FTP-DATA

[Krzysztof Oledzki]

[-- Attachment #1: Type: TEXT/PLAIN, Size: 998 bytes --]



On Tue, 6 Dec 2005, Pieter De Wit wrote:

> Hello Guys,
>
> How would you properly match FTP-DATA connections? I have tried the
> following and after checking the man pages, this should work ?!?
>
> iptables -A INPUT -p tcp -m tcp --dport=21 # For FTP-CTRL
> iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT
> iptables -A INPUT -m state --state RELATED -j ACCEPT
>
> Let's just say outbound is ACCEPT *
>
> For passive FTP that should work, since the firewall (which is on the
> FTP Server) can match that ? Or can it ?

All you need is:
iptables -A INPUT -p tcp --dport 21 -j ACCEPT
iptables -A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
iptables -A INPUT -m conntrack -m helper --state RELATED --helper ftp -j ACCEPT

and:
modprobe ip_conntrack_ftp

You can also use less restricted version:
iptables -A INPUT -p tcp --dport 21 -j ACCEPT
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Best regards,

 			Krzysztof Olędzki

Re: Proper detection of FTP-DATA

[Jan Engelhardt]

>> How would you properly match FTP-DATA connections? I have tried the
>> following and after checking the man pages, this should work ?!?
>> 
>> iptables -A INPUT -p tcp -m tcp --dport=21 # For FTP-CTRL
>> iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT
>> iptables -A INPUT -m state --state RELATED -j ACCEPT

You could also use -m layer7 ;-)
http://l7-filter.sf.net/


Jan Engelhardt
-- 
| Alphagate Systems, http://alphagate.hopto.org/
| jengelh's site, http://jengelh.hopto.org/