On 08/23/2018 11:23 AM, ToddAndMargo wrote:
On 08/23/2018 11:10 AM, Rick Stevens wrote:
> On 08/22/2018 06:00 PM, ToddAndMargo wrote:
>> On 08/22/2018 04:37 PM, Ed Greshko wrote:
>>> On 08/23/18 06:47, ToddAndMargo wrote:
>>>> Hi All,
>>>>
>>>> My iptables firewall ported from RHEL won't connect to ftp sites
>>>> and throws this error (written by me years ago):
>>>>
>>>>
>>>> WARNING: active FTP rules have been selected but one or
>>>> more necessary modules have not been detected
>>>>
>>>> In /etc/sysconfig/iptables-config, you must add ip_nat_ftp
>>>> and ip_conntrack_ftp to IPTABLES_MODULES. Delimiter is a
>>>> space. For example:
>>>> IPTABLES_MODULES=ip_nat_ftp ip_conntrack_ftp
>>>>
>>>> To load changes, use:
>>>> # /etc/rc.d/init.d/iptables restart
>>>> # systemctl restart iptables
>>>>
>>>> To check if modules are loaded, use
>>>> lsmod
>>>>
>>>>
>>>> 1) is Fedora doing FTP differently in iptables?
>>>>
>>>> 2) where do I find
>>>> ip_nat_ftp
>>>> ip_conntrack_ftp
>>>> now a days?
>>>>
>>>
>>> I can't locate my notes at the moment. But I believe the way things
>>> are done in the
>>> netfilter framework has changed.
>>>
>>> If memory servers me the nf_conntrack_ipv4 will load, as needed, the
>>> necessary
>>> "helper". I use the standard firewall and these modules are
loaded.
>>>
>>> xt_conntrack 16384 21
>>> nf_conntrack_ipv6 16384 12
>>> nf_defrag_ipv6 20480 1 nf_conntrack_ipv6
>>> nf_conntrack_ipv4 16384 11
>>> nf_defrag_ipv4 16384 1 nf_conntrack_ipv4
>>> nf_conntrack 147456 6
>>>
xt_conntrack,nf_conntrack_ipv6,nf_conntrack_ipv4,nf_nat,nf_nat_ipv6,nf_nat_ipv4
>>>
>>>
>>> libcrc32c 16384 2 nf_conntrack,nf_nat
>>>
>>> and ftp works fine.
>>>
>>> ip_nat_ftp does not exist on my system. But I do have
>>> nf_conntrack_ftp.
>>
>> I see nf_conntrack_ftp inserted
>>
>> # lsmod | grep nf_conntrack_ftp
>> nf_conntrack_ftp 20480 1 nf_nat_ftp
>> nf_conntrack 147456 9
>>
xt_conntrack,nf_nat_masquerade_ipv4,nf_conntrack_ipv4,nf_nat,nf_nat_ftp,ipt_MASQUERADE,nf_nat_ipv4,xt_helper,nf_conntrack_ftp
>>
>>
>>
>>
>> But it is not following the high ports that ftp uses:
>>
>> Aug 22 16:12:09 rn6 kernel: dsl-out Everything Else IN= OUT=eno2
>> SRC=192.168.xxx.yyy DST=208.106.xxx.yyy LEN=60 TOS=0x00 PREC=0x00 TTL=64
>> ID=25991 DF PROTO=TCP SPT=59698 DPT=21023 WINDOW=29200 RES=0x00 SYN
>> URGP=0
>
> Perhaps I missed this, but are you trying to set up an FTP _server_ on
> your machine or using it as an FTP client? The firewall rules for an
> FTP server would be significantly different--especially if you wish to
> provide both passive and normal FTP operations.
Just ftp client and I want to support both active and passive mode
The advice given here:
https://serverfault.com/questions/203546/client-side-iptables-rule-to-all...
might be relevant.
:m