Login or Register to Ask a Question and Join Our Community


UNIX for Dummies Questions & Answers

iptables-ftp

 
Thread Tools Search this Thread
Top Forums UNIX for Dummies Questions & Answers iptables-ftp
# 1  
Old 09-11-2011
iptables-ftp
I have set up a firewall on my centOS 5.6 box. I copied it from info I found online related to web servers. Everything seems to work fine but my ftp from my LAN. I am not able to ftp into the directories at all. I have the box set up as a test web server. Here is my iptable:
I have opened ports 20,21,22 related to ftp, what might be my problem. The 137-139 ports are related to my samba server, with out those I could not communicate with with my xp, win7 and server 2008 vm's. I thought I understood what was going on.

Code:
#make more difficult for port scans

*mangle
:PREROUTING ACCEPT [444:43563]
:INPUT ACCEPT [444:43563]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [402:144198]
:POSTROUTING ACCEPT [402:144198]
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
COMMIT

#deny all then open ports

*filter
:INPUT DROP [1:242]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:LOG_DROP - [0:0]
:LOG_ACCEPT - [0:0]
:icmp_packets - [0:0]

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 20 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j LOG_ACCEPT
-A INPUT -p tcp -m tcp --dport 25 -j LOG_ACCEPT

-A INPUT -p tcp -m tcp --dport 43 -j ACCEPT
-A INPUT -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 110 -j ACCEPT
-A INPUT -p udp -m udp --dport 137 -j ACCEPT
-A INPUT -p udp -m udp --dport 138 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 139 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 143 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 445 -j ACCEPT

-A INPUT -p udp -m udp --dport 793 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 993 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 3306 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8080 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8181 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8008 -j ACCEPT
-A INPUT -s 127.0.0.1 -j ACCEPT
-A INPUT -p icmp -j icmp_packets
-A INPUT -j LOG_DROP

-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 20 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 21 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 23 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 43 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 110 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 137 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 138 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 139 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 143 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 445 -j ACCEPT

-A OUTPUT -p udp -m udp --dport 793 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 993 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 3306 -j ACCEPT
-A OUTPUT -d 127.0.0.1 -j ACCEPT
-A OUTPUT -p icmp -j icmp_packets
-A OUTPUT -j LOG_DROP

# ping stop part

-A icmp_packets -p icmp -m icmp --icmp-type 0 -j ACCEPT
-A icmp_packets -s 192.168.0.170 -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A icmp_packets -s 192.168.0.197 -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A icmp_packets -p icmp -m icmp --icmp-type 8 -j DROP
-A icmp_packets -p icmp -m icmp --icmp-type 3 -j ACCEPT
-A icmp_packets -p icmp -m icmp --icmp-type 11 -j ACCEPT
COMMIT

Last edited by pludi; 09-11-2011 at 07:32 PM..
# 2  
Old 09-12-2011
Which side of the firewall is your client on?

Did you try PASV? FTP moves files and listings by a reverse connection from port 21? to listening high port on client, but often, with a firewall, it is preferable or required to us PASV mode, where the client makes the connection to a firewall listener on a high port. You may need a high port rule.

Where did you get 22? File Transfer Protocol - Wikipedia, the free encyclopedia
# 3  
Old 09-12-2011
Thanks DG.

The client is on the outside. Yes I did try passive. I redid my firewall a little. I need to do some reading on the higher port rule you mentioned. I keep considering port 22 ftp because I do web design for a living and my hosting company uses what they call sftp on port 22, it's not technically ftp. Question on the first part of my firewall which if understand right is deny all then open what I need. If I put DROP in the OUTPUT under the filter, I have the local ftp problem, with ACCEPT it works. Everything else works either way. I am assuming that's where I need some understanding on exactly where things are moving around and set up the higher port rule. How unsecure is it if I leave the ACCEPT there? I have a home network with a bunch of vm clients and servers set up for me to experiment with but like have the web server and ftp to the outside world so I can grab files when I need them and test things with out having to log into my hosing company's servers.

Code:
*filter
:INPUT DROP [1:242]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:LOG_DROP - [0:0]
#:LOG_ACCEPT - [0:0]
:icmp_packets - [0:0]

# Allow traffic already established to continue

-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow web services

-A INPUT -p tcp --dport ssh -j ACCEPT
-A INPUT -p tcp --dport domain -j ACCEPT
-A INPUT -p tcp --dport ftp -j ACCEPT
-A INPUT -p udp --dport ftp -j ACCEPT
-A INPUT -p tcp --dport ftp-data -j ACCEPT
-A INPUT -p udp --dport ftp-data -j ACCEPT
-A INPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT
-A INPUT -p tcp --dport 25 -j ACCEPT
-A INPUT -p tcp --dport 465 -j ACCEPT
-A INPUT -p tcp --dport 110 -j ACCEPT
-A INPUT -p tcp --dport 137:139 -j ACCEPT
-A INPUT -p udp --dport 137:139 -j ACCEPT
-A INPUT -p tcp --dport 143 -j ACCEPT
-A INPUT -p tcp --dport 585 -j ACCEPT
-A INPUT -p tcp --dport 993 -j ACCEPT
-A INPUT -p tcp --dport 995 -j ACCEPT
-A INPUT -p tcp --dport 8080 -j ACCEPT
-A INPUT -p tcp --dport 8181 -j ACCEPT



# Allow local loopback services

-A INPUT -i lo -j ACCEPT

# Allow OUTPUT

-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp --dport ssh -j ACCEPT
-A OUTPUT -p tcp --dport domain -j ACCEPT
-A OUTPUT -p tcp --dport ftp -j ACCEPT
-A OUTPUT -p udp --dport ftp -j ACCEPT
-A OUTPUT -p tcp --dport ftp-data -j ACCEPT
-A OUTPUT -p udp --dport ftp-data -j ACCEPT
-A OUTPUT -p tcp --dport 80 -j ACCEPT
-A OUTPUT -p tcp --dport 443 -j ACCEPT
-A OUTPUT -p tcp --dport 25 -j ACCEPT
-A OUTPUT -p tcp --dport 465 -j ACCEPT
-A OUTPUT -p tcp --dport 110 -j ACCEPT
-A OUTPUT -p tcp --dport 137:139 -j ACCEPT
-A OUTPUT -p udp --dport 137:139 -j ACCEPT
-A OUTPUT -p tcp --dport 143 -j ACCEPT
-A OUTPUT -p tcp --dport 585 -j ACCEPT
-A OUTPUT -p tcp --dport 993 -j ACCEPT
-A OUTPUT -p tcp --dport 995 -j ACCEPT
-A OUTPUT -p tcp --dport 8080 -j ACCEPT
-A OUTPUT -p tcp --dport 8181 -j ACCEPT

# Allow everything from home
-A INPUT -p all -s 192.168.0.1/24 -j ACCEPT


# Allow pings

-I INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
-I INPUT -p icmp --icmp-type source-quench -j ACCEPT
-I INPUT -p icmp --icmp-type time-exceeded -j ACCEPT
-A icmp_packets -p icmp -m icmp --icmp-type 0 -j ACCEPT
-A icmp_packets -s 192.168.0.170 -p icmp -m icmp --icmp-type 8 -j ACCEPT
#-A icmp_packets -s 192.168.0.197 -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A icmp_packets -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A icmp_packets -p icmp -m icmp --icmp-type 3 -j ACCEPT
-A icmp_packets -p icmp -m icmp --icmp-type 11 -j ACCEPT
COMMIT

# 4  
Old 09-13-2011
When you initially connect to ftp, the client hig port connects to ftp server port 21. If the user want to move a file or do a listing, the client provides a port and the server creates a data connection, connects from server port 20 to client specifed (high) port. This is one of the only places a specified port is used as a tcp client. Maybe the ftp designer was afraid all ports wuld be taken, so he reserved one! Smilie It does identify the ftp activity to the firewall better than the PASV option, where a data connection is from client high port to server specified high port. So for not PASV, you need a rule that says connections from tcp port 20 or to 21 on the ftp server side are both OK.

PASV was nicer for clients inside a firewall, where all connections originate in the client and the firewall does not need ot support internal listeners, which might be hacker entry services. You need a global high port inside connect ot high port outside permission. This also allows internal clients to hit outside high port http urls, like: "http://some-not-root-http-server-host:some_high_port/"
This User Gave Thanks to DGPickett For This Post:
ktb231
# 5  
Old 09-13-2011
I got it working and understand a lot more. My new problem is my ftp-users group can log into home directories from outside like they should but can also move around my whole drive. They can only upload or download in their home directories but they can view everything.Smilie
# 6  
Old 09-14-2011
Well, there is a facility called chroot, or ftp server settings, that can make their home dir the root of their view. The latter protection sometimes fails when the user adds a symlink like: ~/root to /

You could give them the same facilities in a web tool, and not mess with nasty old ftp. I just uploaded my resume on comcast home with a nice web 2.0 tool they provide. FTP is very old and a challenge to firewalls and NAT with IP addresses in the message flow and multiple connections in both directions.

BTW, sftp and scp are just ssh in a compatible wrapper. They run on different servers, are secure, do not use multiple connection, connections in both directions or IP addresses inside message flow. They are secure and usually offer compression. I like scp, one line not reams of scripted steps. Their forerunners rlogin/rsh/rcp had security and design problems, and so fell into disrepute, but have no encryption overhead.
# 7  
Old 09-14-2011
I do have them chrooted, interesting on the symbolic link deal. The ftp was more for me to setup to see how it worked and somewhat be able to grab files if I needed them.

A web tool is not a bad idea. I could do a perl script upload to a secure directory. Part of the reason for giving access is I have an idiot friend who is hell bent on sending 10mb videos via email. It completely messes up my phone when I have to wait for them to download. Not only are they big but his email server must time out before verification of sent so I sometimes get 10 copies and have to block his email for a few days until it clears out. I wanted to offer him something that he can upload to and just send a link to view at my leisure. Thanks again for the help.
 
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. IP Networking

iptables problem with ftp

I have a pretty stock iptables script. One rule allows active ftp from an outside IP address. To troubleshoot it, I opened up ftp to all connections from the outside. When a user outside our domain connects via FTP, they are denied. If I flush the rules, the ftp takes place successfully. This... (2 Replies)
Discussion started by: bricoleur
2 Replies

2. IP Networking

vsftp | active and passive ftp | iptables

I am using vsftp but I can't login with passive mode. I can only login with active mode. I can login with both mode when service of iptables is stop. In active mode : 20,21 must be open from server site. 1023 and over must be open at client site. In passive mode : only 21,1023 and over must be... (1 Reply)
Discussion started by: getrue
1 Replies

3. HP-UX

[Solved] Unable to rename file in ftp server .Net:FTP perl

Hello All, I am trying to connect to ftp server and get the files. Also i need to rename the file in other ftp dir. rename method is not allowing me to rename the file in other dir. When i tried copy command by using net::FTP:FILE then perl says it is not installed. Can some body help me to... (2 Replies)
Discussion started by: krsnadasa
2 Replies

4. Red Hat

iptables ftp denies ls

Hi, Following is the output of iptables -S command -P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -A INPUT -s 192.168.0.5/32 -p tcp -m tcp --dport 22 -j ACCEPT -A INPUT -s 192.168.0.5/32 -p udp -m udp --dport 22 -j ACCEPT -A INPUT -s 192.168.0.0/24 -p udp -m udp --dport 20 -j... (3 Replies)
Discussion started by: shahdharmit
3 Replies

5. Shell Programming and Scripting

Block incoming traffic FTP from internet using iptables

Hi everybody. I have the next scenary: eth0: WAN eth1: DMZ eth2: LAN I need to block all incoming trafic from the internet through my network LAN using iptables. I have squid but i need to do this using ipatbles. I have been listening about iptables -A FORDAWARD but I am stuck right... (0 Replies)
Discussion started by: edeamat
0 Replies

6. Shell Programming and Scripting

Automated FTP script using .netrc to multiple FTP servers

Hi all, I'm using the following script to automated ftp files to 1 ftp servers host=192.168.0.1 /usr/bin/ftp -vi >> $bkplog 2>&1 <<ftp open $host bin cd ${directory} put $files quit ftp and the .netrc file contain machine 192.168.0.1 login abc... (4 Replies)
Discussion started by: varu0612
4 Replies

7. UNIX for Advanced & Expert Users

Using FTP to check whether file is completely FTP... plz find the description below

Hi, We have some clients who will place huge files in to one of the remote server. And the shell script written in our local server to retrieve client files (using FTP) placed on one of the remote server of ours by clients. My question Is there any FTP command/script to check from my local... (1 Reply)
Discussion started by: nmsrao
1 Replies

8. IP Networking

Ftp'ing thru a Iptables NAT Masquerade

Greetings to all. My new firewall is giving me one hell of a problem. I'm running iptables and masquerading my intranet thru NAT. But here is the problem. Whenever I try to FTP to a server outside of my lan I get a 500 illegal port error. I've come to the conclusion that NAT is... (2 Replies)
Discussion started by: phrater
2 Replies

9. Cybersecurity

iptables: block/allow ftp

I have 2 LAN's, seperated by a firewall, running iptables on it. I want only allow ftp access from one to the other LAN. Server 1 in LAN 1 should have ftp access to Server 2 in LAN 2 Server 2 in LAN 2 should not have ftp access to Server 1 in LAN 1. Can someone tell me how to set up the... (5 Replies)
Discussion started by: sTorm
5 Replies

10. UNIX for Dummies Questions & Answers

iptables, ftp

I have allready opened a thread about this, but my question was really weird formed, so I'm writting it here again: I have a Network with 4 FTP Servers, then a firewall, and then a Network with clients. The clients should have access to the FTP Servers, but it should not be possible to connect... (2 Replies)
Discussion started by: sTorm
2 Replies
Login or Register to Ask a Question