On 08/22/2018 03:59 PM, Rick Stevens wrote:
On 08/22/2018 03:47 PM, ToddAndMargo wrote:
> Hi All,
>
> My iptables firewall ported from RHEL won't connect to ftp sites
> and throws this error (written by me years ago):
>
>
> WARNING: active FTP rules have been selected but one or
> more necessary modules have not been detected
>
> In /etc/sysconfig/iptables-config, you must add ip_nat_ftp
> and ip_conntrack_ftp to IPTABLES_MODULES. Delimiter is a
> space. For example:
> IPTABLES_MODULES=ip_nat_ftp ip_conntrack_ftp
>
> To load changes, use:
> # /etc/rc.d/init.d/iptables restart
> # systemctl restart iptables
>
> To check if modules are loaded, use
> lsmod
>
>
> 1) is Fedora doing FTP differently in iptables?
No, but Fedora, by defaults, locks down the network a lot more
than older RHEL systems. If you're using Network Manager, you can use
it to open the FTP ports necessary on your machine. Or you can edit
the /etc/sysconfig/iptables-config file and add those modules
> 2) where do I find
> ip_nat_ftp
> ip_conntrack_ftp> now a days?
They're included in the kernel RPM. If you must know, they're
located in:
/lib/modules/`uname -r`/kernel/net/netfilter
I am finding these inserted:
# lsmod | grep ftp
nf_nat_ftp 16384 0
nf_conntrack_ftp 20480 1 nf_nat_ftp
nf_nat 36864 3
nf_nat_masquerade_ipv4,nf_nat_ftp,nf_nat_ipv4
nf_conntrack 147456 9
xt_conntrack,nf_nat_masquerade_ipv4,nf_conntrack_ipv4,nf_nat,nf_nat_ftp,ipt_MASQUERADE,nf_nat_ipv4,xt_helper,nf_conntrack_ftp
Is this adequate?
So I do not have to dnf the filters. Simpler.
# ls /lib/modules/`uname -r`/kernel/net/netfilter | grep -i ftp
nf_conntrack_ftp.ko.xz
nf_conntrack_tftp.ko.xz
nf_nat_ftp.ko.xz
nf_nat_tftp.ko.xz
And the ones I use to use (ip_nat_ftp, ip_conntrack_ftp) are
not showing up. Does Fedora even require these any more?
Here is the error I am getting from iptables:
Aug 22 16:12:09 rn6 kernel: dsl-out Everything Else IN= OUT=eno2
SRC=192.168.xxx.yyy DST=208.106.xxx.yyy LEN=60 TOS=0x00 PREC=0x00 TTL=64
ID=25991 DF PROTO=TCP SPT=59698 DPT=21023 WINDOW=29200 RES=0x00 SYN URGP=0
Which means ftp it trying to establish high ports, which is what
it is suppose to do. The problem is that I am not tracking them,
as I should. "ip_conntrack_ftp" use to do this.
What am I missing?
-T