[lkml]   [2000]   [Dec]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: iptables: "stateful inspection?"
On Wed, 20 Dec 2000, Michael Rothwell wrote:

>"Michael H. Warfield" wrote:
>> I think that's more than a little overstatement on your
>> part. It depends entirely on the application you intend to put
>> it to.
>Fine. How do I make FTP work through it? How can I allow all outgoing
>TCP connections without opening the network to inbound connections on
>the ports of desired services?

# Set local port range to be higher.
net.ipv4.ip_local_port_range = 32768 33792

passive ports 32768 36863

Firewall script:

# Client FTP
ipchains -A output -j ACCEPT -p tcp -s $IP $STDPORT -d ftp-data -y -l
ipchains -A output -j ACCEPT -p tcp -s $IP $STDPORT -d ftp-data
ipchains -A output -j ACCEPT -p tcp -s $IP $STDPORT -d ftp -y -l
ipchains -A output -j ACCEPT -p tcp -s $IP $STDPORT -d ftp

# Server FTP
ipchains -A input -j ACCEPT -p tcp -s ftp-data -d $IP $STDPORT # Needs SYN
ipchains -A input -j ACCEPT -p tcp -s ftp -d $IP $STDPORT ! -y

[now deny all for all chains]

Unfortunately, any FTP server that doesn't use port 20 for data streams
won't work in Passive mode (oh well). So I just download elsewhere first
and then get it locally for browsers that insist upon Passive.

For allowing outgoing connections without inbound, you'd use:

ipchains -A input -j DENY -p tcp -y

or if that complains:

ipchains -A input -j DENY -p tcp -s -d $IP -y

You'll notice above I used '! -y' on the Server FTP rule. If I missed a
detail, it might be due to trying to condense everything I have into what
you wanted.

-George Greer

(7,323 and 189 lines in my firewall rule script.)

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
Please read the FAQ at

 \ /
  Last update: 2005-03-22 12:52    [W:0.075 / U:0.532 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site