On 08/24/2018 09:35 AM, Rick Stevens wrote:
Here are my "passive rules"
# ftp passive mode (browser) stuff. Note: ftp_conntrack module is
required, e.g.:
# /etc/sysconfig/iptables-config:
# IPTABLES_MODULES="ip_conntrack_ftp"
#
$tbls -A dsl-out -o $eth1 -p tcp -s $eth1_addr --sport $unassgn
--dport ftp -m state --state NEW,ESTABLISHED -j ACCEPT
$tbls -A dsl-in -i $eth1 -p tcp ! --syn --sport ftp -d $eth1_addr
--dport $unassgn -m state --state RELATED,ESTABLISHED -j ACCEPT
$tbls -A dsl-for -i $eth1 -p tcp ! --syn --sport ftp -d $internal_net
--dport $unassgn -m state --state RELATED,ESTABLISHED -j ACCEPT
# The "ftpdata" session is a "new" one when it sends the SYN. However,
the ftp_conntrack module marks it as related to its controlling
# ftp session, so that state=related matches. This should deny any
"ftpdata" session that doesn't have a controlling ftp session.
#$tbls -A dsl-out -o $eth1 -p tcp -s $eth1_addr --sport $unassgn -d
$ANY_IP --dport $unassgn -m state --state RELATED,ESTABLISHED
-j ACCEPT
#$tbls -A dsl-in -i $eth1 -p tcp ! --syn -s $ANY_IP --sport
$unassgn -d $eth1_addr --dport $unassgn -m state --state
RELATED,ESTABLISHED -j ACCEPT
#$tbls -A dsl-for -i $eth1 -p tcp ! --syn -s $ANY_IP --sport
$unassgn -d $internal_net --dport $unassgn -m state --state
RELATED,ESTABLISHED -j ACCEPT
$tbls -A dsl-out -o $eth1 -p tcp -s $eth1_addr -d $ANY_IP
-m helper --helper ftp -m state --state RELATED,ESTABLISHED -j ACCEPT
$tbls -A dsl-in -i $eth1 -p tcp ! --syn -s $ANY_IP -d $eth1_addr
-m helper --helper ftp -m state --state RELATED,ESTABLISHED -j ACCEPT
$tbls -A dsl-for -i $eth1 -p tcp ! --syn -s $ANY_IP -d $internal_net
-m helper --helper ftp -m state --state RELATED,ESTABLISHED -j ACCEPT
_______________________________________________
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-le...@lists.fedoraproject.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/users@lists.fedoraproject.org/message/YHMRSXXMXUHJS4UXDHHLRLTREM3WUNJW/
