On 08/24/2018 09:35 AM, Rick Stevens wrote:
Here are my "passive rules"
# ftp passive mode (browser) stuff. Note: ftp_conntrack module is required, e.g.: # /etc/sysconfig/iptables-config: # IPTABLES_MODULES="ip_conntrack_ftp" # $tbls -A dsl-out -o $eth1 -p tcp -s $eth1_addr --sport $unassgn --dport ftp -m state --state NEW,ESTABLISHED -j ACCEPT $tbls -A dsl-in -i $eth1 -p tcp ! --syn --sport ftp -d $eth1_addr --dport $unassgn -m state --state RELATED,ESTABLISHED -j ACCEPT $tbls -A dsl-for -i $eth1 -p tcp ! --syn --sport ftp -d $internal_net --dport $unassgn -m state --state RELATED,ESTABLISHED -j ACCEPT # The "ftpdata" session is a "new" one when it sends the SYN. However, the ftp_conntrack module marks it as related to its controlling # ftp session, so that state=related matches. This should deny any "ftpdata" session that doesn't have a controlling ftp session. #$tbls -A dsl-out -o $eth1 -p tcp -s $eth1_addr --sport $unassgn -d $ANY_IP --dport $unassgn -m state --state RELATED,ESTABLISHED -j ACCEPT #$tbls -A dsl-in -i $eth1 -p tcp ! --syn -s $ANY_IP --sport $unassgn -d $eth1_addr --dport $unassgn -m state --state RELATED,ESTABLISHED -j ACCEPT #$tbls -A dsl-for -i $eth1 -p tcp ! --syn -s $ANY_IP --sport $unassgn -d $internal_net --dport $unassgn -m state --state RELATED,ESTABLISHED -j ACCEPT $tbls -A dsl-out -o $eth1 -p tcp -s $eth1_addr -d $ANY_IP -m helper --helper ftp -m state --state RELATED,ESTABLISHED -j ACCEPT $tbls -A dsl-in -i $eth1 -p tcp ! --syn -s $ANY_IP -d $eth1_addr -m helper --helper ftp -m state --state RELATED,ESTABLISHED -j ACCEPT $tbls -A dsl-for -i $eth1 -p tcp ! --syn -s $ANY_IP -d $internal_net -m helper --helper ftp -m state --state RELATED,ESTABLISHED -j ACCEPT