Sponsored Content
Full Discussion: iptables: block/allow ftp
Special Forums Cybersecurity iptables: block/allow ftp Post 17794 by sTorm on Wednesday 20th of March 2002 07:38:20 AM
Old 03-20-2002
For those who want to know, here is the iptables rule to block ftp connection requests from one side, and allow the request from the other:

# ftp control connection
iptables -A FORWARD -i eth1 -o eth0 -p TCP --sport 1024:65535 --dport ftp -j ACCEPT
iptables -A FORWARD -i eth0 -o eth1 -p TCP ! --syn --sport ftp --dport 1024:65535 -j ACCEPT

! --syn
Means, there's no connection request. Therefore, the packet can continue it's way through the firewall.

Just in case somebody wants to know.
 

10 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

iptables, ftp

I have allready opened a thread about this, but my question was really weird formed, so I'm writting it here again: I have a Network with 4 FTP Servers, then a firewall, and then a Network with clients. The clients should have access to the FTP Servers, but it should not be possible to connect... (2 Replies)
Discussion started by: sTorm
2 Replies

2. Shell Programming and Scripting

FTP inside a block of code

I need help on the code below. I am getting a compile error syntax error at line 283 : `<<' unmatched Looks like it doesn't like the << on the ftp line below. If I ran the code outside of this block everything work fine, but when I put in a block of code or in a function, I got syntax error. I... (1 Reply)
Discussion started by: leemjesse
1 Replies

3. Solaris

Want to block ftp for root user

Hi Friends, I would like to block the root user for doing ftp. As I am aware that I need to put the entry for root in /etc/ftpusers.....am I right...??? But I am not able to edit the file & even more command is not working. #ls -l ftp* total 14 -rw-r--r-- 1 root sys 1249 Jun... (3 Replies)
Discussion started by: jumadhiya
3 Replies

4. UNIX for Dummies Questions & Answers

How to block an anonymous ftp user?

Could anyone provide information on how to block a specific client machine from being able to log onto anonymous ftp? (10 Replies)
Discussion started by: dennisheazle
10 Replies

5. Shell Programming and Scripting

Block incoming traffic FTP from internet using iptables

Hi everybody. I have the next scenary: eth0: WAN eth1: DMZ eth2: LAN I need to block all incoming trafic from the internet through my network LAN using iptables. I have squid but i need to do this using ipatbles. I have been listening about iptables -A FORDAWARD but I am stuck right... (0 Replies)
Discussion started by: edeamat
0 Replies

6. AIX

Block users ftp service

Hello everyone I create a file /etc/ftpusers to block users. I put the names of the users and I refresh the service inetd. My question is the user still log in by ftp.???? What I miss Thanks for your opinions. Greetings (2 Replies)
Discussion started by: lo-lp-kl
2 Replies

7. UNIX for Dummies Questions & Answers

iptables-ftp

I have set up a firewall on my centOS 5.6 box. I copied it from info I found online related to web servers. Everything seems to work fine but my ftp from my LAN. I am not able to ftp into the directories at all. I have the box set up as a test web server. Here is my iptable: I have opened ports... (7 Replies)
Discussion started by: ktb231
7 Replies

8. Red Hat

iptables ftp denies ls

Hi, Following is the output of iptables -S command -P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -A INPUT -s 192.168.0.5/32 -p tcp -m tcp --dport 22 -j ACCEPT -A INPUT -s 192.168.0.5/32 -p udp -m udp --dport 22 -j ACCEPT -A INPUT -s 192.168.0.0/24 -p udp -m udp --dport 20 -j... (3 Replies)
Discussion started by: shahdharmit
3 Replies

9. IP Networking

vsftp | active and passive ftp | iptables

I am using vsftp but I can't login with passive mode. I can only login with active mode. I can login with both mode when service of iptables is stop. In active mode : 20,21 must be open from server site. 1023 and over must be open at client site. In passive mode : only 21,1023 and over must be... (1 Reply)
Discussion started by: getrue
1 Replies

10. IP Networking

iptables problem with ftp

I have a pretty stock iptables script. One rule allows active ftp from an outside IP address. To troubleshoot it, I opened up ftp to all connections from the outside. When a user outside our domain connects via FTP, they are denied. If I flush the rules, the ftp takes place successfully. This... (2 Replies)
Discussion started by: bricoleur
2 Replies
atmelan(8)						      System Manager's Manual							atmelan(8)

NAME
atmelan - Configures LAN-Emulation clients as network interfaces. SYNOPSIS
/usr/sbin/atmelan command arguments OPTIONS
This section is organized by the tasks you can perform with the atmelan command. Each task subsection provides the atmelan command syntax and the arguments to use to complete the tasks. Creating a LAN-Emulation Client Syntax: /usr/sbin/atmelan create driver=name [type=type] [mtu=mtu] [name=elan_name] [lecs=addr [,addr, addr, addr] | les=addr] [unit=unit_number | elan=unit_number] Creates a new LAN-Emulation Client (LEC) and configures it as a network interface. If no additional arguments are specified, the defaults are 802.3 type and an MTU of 1516 bytes. Specifies the physical interface with which to associate the new LEC. Specifies the interface type. The following types are supported: Ethernet/802.3. Specifies the message transfer unit (MTU) size. The following MTU sizes are sup- ported: 1516, 4544, 9234, and 18190. When specified with the name option, the emulated LAN must already be configured on the ATM switch to support the specified MTU size. If it is not configured for the specified MTU size, the request is ignored. Specifies the name of the emulated LAN to join. The emulated LAN name must already be configured on the ATM switch. If the name is not configured on the ATM switch, the LEC joins the default emulated LAN. Note You can join an emulated LAN on a switch only once for each adapter; do not join the same elan multiple times from the same adapter. If you want to join the same emulated LAN on the same switch, you must install another adapter and join the emulated LAN from it. Specifies that the LEC connect to the LAN-Emulation Configuration Server (LECS) at the ATM address specified by the addr arguments for the emulated LAN configuration. You can specify up to 4 addresses. The LEC tries the addresses in order until a successful configuration has been completed. If all addresses fail, the "well known address" is tried before the process begins again. If no lecs option is specified (default), the LEC connects to the LECS at the "well known address". Do not use the lecs option with the les option. Specifies that the LEC go directly to the LAN-Emulation Server (LES) at the ATM address specified by addr argument and bypass the configuration phase. If this argument is not specified, the LEC contacts a LAN-Emulation Configuration Server (LECS) to obtain a LES address. Do not use the les option with the lecs option. Specifies a LEC interface unit number. Specifies an ELAN unit number. For example, to create an emulated LAN interface using Ethernet frame format and Fiber Distributed Data Interface (FDDI) frame sizes, enter: # atmelan create driver=lta0 mtu=4544 To create an emulated LAN interface that bypasses the configuration phase and directly contacts a LAN-Emulation Server (LES), enter: # atmelan create les=LES_A The ATM address is an alias that is in the /etc/atmhosts file. Detaching a LEC Interface from an ATM Network Syntax: /usr/sbin/atmelan detach unit=unit_number | elan=unit_number Detaches a LEC interface specified by either unit or elan arguments from an ATM network. Specifies a LEC interface unit number. The unit_number is obtained by the netstat -i command. Specifies an ELAN unit number. The unit_number is obtained by the netstat -i command. Attaching a LEC Interface to an ATM Network Syntax: /usr/sbin/atmelan attach driver=name unit=unit_number | elan=unit_number [lecs=addr [,addr, addr, addr] | les=addr] [name=elan_name] [type=type] [mtu=mtu] Attaches the specified, previously detached LEC network interface to an ATM network. After the LEC interface is attached, issue the ifcon- fig elanx up command to configure the interface. Specifies the physical interface with which to associate the LEC. Specifies a LEC inter- face unit number. This is the unit number that was previously detached. Specifies an ELAN unit number. This is the unit number that was previously detached. Specifies that the LEC connect to the LAN-Emulation Configuration Server (LECS) at the ATM address specified by the addr arguments for the emulated LAN configuration. You can specify up to 4 addresses. The LEC tries the addresses in order until a suc- cessful configuration has been completed. If all addresses fail, the "well known address" is tried before the process begins again. If no lecs option is specified (default), the LEC connects to the LECS at the "well known address". Do not use the lecs option with the les option. Specifies that the LEC go directly to the LAN-Emulation Server (LES) at the ATM address specified by addr argument and bypass the configuration phase. If this argument is not specified, the LEC contacts a LAN-Emulation Configuration Server (LECS) to obtain a LES address. Do not use the les option with the lecs option. Specifies the name of the emulated LAN to join. The emulated LAN name must already be configured on the ATM switch. If the name is not configured on the ATM switch, the LEC joins the default emulated LAN. Speci- fies the interface type. The following types are supported: Ethernet/802.3. Specifies the message transfer unit (MTU) size. The following MTU sizes are supported: 1516, 4544, 9234, and 18190. When specified with the name option, the emulated LAN must already be configured on the ATM switch to support the specified MTU size. If it is not configured for the specified MTU size, the request is ignored. Displaying State and Counters for an LEC Interface Syntax: /usr/sbin/atmelan show | status [unit=unit_number] Shows the state and counters for a LEC interface. If no unit number is specified, information for LEC unit 0 (elan0) is displayed. Shows the state and counters for a LEC interface. If no unit number is specified, information for LEC unit 0 (elan0) is displayed. Specifies a LEC interface unit number, if you want to display LEC information for LEC unit numbers other than unit 0 (elan0). The unit_number is obtained by the netstat -i command. For example, unit 0 is elan0, unit 1 is elan1, and so on. DESCRIPTION
The atmelan command creates and configures LAN-Emulation Clients (LEC) as network interfaces. The first interface created appears as elan0, the second as elan1, and so on. The atmelan command can also show counters, parameters, and the state of each LEC. SEE ALSO
Commands: atmconfig(8), atmsig(8), learp(8) Files: atmhosts(4) Asynchronous Transfer Mode Network Administration atmelan(8)
All times are GMT -4. The time now is 05:56 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy