[lkml]   [1999]   [May]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: PATCH: ipchains, support for dynamic ftp-data-connection rules
On Fri, 21 May 1999, Neale Banks wrote:

> > 2) dynamic FTP-data connection rules. (attached file patch.ipchains.gz NOT
> > necessary for this!!! I repeat it!)
> > It is now possible to block _everything_ except for connections to port
> > 21@ftp-server, the necessary data-connections are allowed through 'on
> > demand', i.e. the code scans for the ftp PORT-command and creates a
> > dynamic rule that allows the data connection in. This rule times out like
> > masquerading rules.
> Nice :-)
> [...]
> > Packets are tested against ftp-data rules before all others. Tested are
> > only: src/dst IP and port and protocol. Those 5 values describe exactly
> > one connection, always and everywhere, and we already know we want to let
> > it through.
> Request: can we drop the "Packets are tested against ftp-data rules
> before all others" bit so we can call the ftp-data rule from wherever we
> want to in our rule-set (OK, I'm paranoid ;-)?

Done. But this time I didn't attach 10k... Did I post to too many lists?
No complaints so far, and I still think this subject is relevant for all
of them, but you never know...

The new version of the patch is at

Example of my rules used for testing this time (ipchains-save),
connections from test-host to one test ftp server:
:input ACCEPT
:forward ACCEPT
:output ACCEPT
:ftp-data -
-A input -s 21:21 -d -i
eth1 -p 6 -j ACCEPT ! -y
-A input -s 20:20 -d -i
eth1 -p 6 -j ftp-data
-A input -s -d -i eth1
-p 6 -j REJECT
-A output -s -d 21:21
-i eth1 -p 6 -j ACCEPT
-A output -s -d 20:20
-i eth1 -p 6 -j ftp-data
-A output -s -d -i eth1
-p 6 -j REJECT

SuSE Linux
SuSE GmbH, Nuernberg, Germany

Michael Hasenstein
Private Pilot (ASEL) since 1998

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:51    [W:0.034 / U:5.944 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site