OpenForum RSS: �� passive ftp � iptables

�� passive ftp � iptables (OldDiesel)

Thu, 09 Apr 2009 09:53:13 GMT

�� , �� , ��

�� iptables -P OUTPUT ACCEPT, ��

�� (�� RELATED,ESTABLISHED �� ), � �� .... �� NEW � ��, � ��
>>iptables -A INPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
>>iptables -A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
>>iptables -A FORWARD -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT

�� :
iptables -A INPUT -j ACCEPT
iptables -A OUTPUT -j ACCEPT
iptables -A FORWARD -j ACCEPT
:D

�� :

#�� OUTPUT
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP

�� (ESTABLISHED) � ��(RELATED) ��.
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCE

�� passive ftp � iptables (Alexander)

Fri, 13 Jun 2008 12:07:59 GMT

>[�� ]
>>>packet died: "
>>>� ��
>>
>>Jun 13 11:45:12 linux-h3wk kernel: IPT FORWARD packet died: IN=eth1 OUT=eth2 SRC=192.168.163.67 DST=<cut> LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=25229 DF PROTO=TCP SPT=42140 DPT=59461 WINDOW=183 RES=0x00
>> ACK URGP=0
>>Jun 13 11:45:15 linux-h3wk kernel: IPT FORWARD packet died: IN=eth1 OUT=eth2 SRC=192.168.163.67 DST=<cut> LEN=64 TOS=0x08 PREC=0x00 TTL=63 ID=25230 DF PROTO=TCP SPT=42140 DPT=59461 WINDOW=183 RES=0x00
>> ACK URGP=0
>>Jun 13 11:45:21 linux-h3wk kernel: IPT FORWARD packet died: IN=eth1 OUT=eth2 SRC=192.168.163.67 DST=<cut> LEN=64 TOS=0x08 PREC=0x00 TTL=63 ID=25231 DF PROTO=TCP SPT=42140 DPT=59461 WINDOW=183 RES=0x00
>
>�� .

�� 20, 21 �� ?
�� FORWARD �� , � 21 � 20 �� , �� /var/log/firewall �� .

�� passive ftp � iptables (skgennady)

Fri, 13 Jun 2008 10:59:06 GMT

>>�� :
>>iptables -A FORWARD -p tcp -j LOG --log-level DEBUG --log-prefix "IPT FORWARD
>>packet died: "
>>� ��
>
>Jun 13 11:45:12 linux-h3wk kernel: IPT FORWARD packet died: IN=eth1 OUT=eth2 SRC=192.168.163.67 DST=<cut> LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=25229 DF PROTO=TCP SPT=42140 DPT=59461 WINDOW=183 RES=0x00
> ACK URGP=0
>Jun 13 11:45:15 linux-h3wk kernel: IPT FORWARD packet died: IN=eth1 OUT=eth2 SRC=192.168.163.67 DST=<cut> LEN=64 TOS=0x08 PREC=0x00 TTL=63 ID=25230 DF PROTO=TCP SPT=42140 DPT=59461 WINDOW=183 RES=0x00
> ACK URGP=0
>Jun 13 11:45:21 linux-h3wk kernel: IPT FORWARD packet died: IN=eth1 OUT=eth2 SRC=192.168.163.67 DST=<cut> LEN=64 TOS=0x08 PREC=0x00 TTL=63 ID=25231 DF PROTO=TCP SPT=42140 DPT=59461 WINDOW=183 RES=0x00

�� .

�� passive ftp � iptables (skgennady)

Fri, 13 Jun 2008 10:57:50 GMT

> # passive ftp
> iptables -A FORWARD -p tcp --sport 1024:65535 --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
> iptables -A FORWARD -p tcp --sport 21 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT
> iptables -A FORWARD -p tcp --sport 1024:65535 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT
> iptables -A FORWARD -p TCP --dport 20 -j ACCEPT
> iptables -A FORWARD -p TCP --sport 20 -j ACCEPT
> iptables -A FORWARD -p TCP --dport 21 -j ACCEPT
> iptables -A FORWARD -p TCP --sport 21 -j ACCEPT

� �� . � �� :
iptables -P FORWARD DROP
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -A FORWARD -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -p tcp -m state --state NEW --dport 21 -j ACCEPT
iptables -A FORWARD -p tcp -m state --state NEW --sport 20 -j ACCEPT
iptables -A FORWARD -p icmp -j ACCEPT
�� . ��-��, ��

�� passive ftp � iptables (Alexander)

Fri, 13 Jun 2008 10:55:21 GMT

>�� :
>iptables -A FORWARD -p tcp -j LOG --log-level DEBUG --log-prefix "IPT FORWARD
>packet died: "
>� ��

Jun 13 11:45:12 linux-h3wk kernel: IPT FORWARD packet died: IN=eth1 OUT=eth2 SRC=192.168.163.67 DST=<cut> LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=25229 DF PROTO=TCP SPT=42140 DPT=59461 WINDOW=183 RES=0x00
ACK URGP=0
Jun 13 11:45:15 linux-h3wk kernel: IPT FORWARD packet died: IN=eth1 OUT=eth2 SRC=192.168.163.67 DST=<cut> LEN=64 TOS=0x08 PREC=0x00 TTL=63 ID=25230 DF PROTO=TCP SPT=42140 DPT=59461 WINDOW=183 RES=0x00
ACK URGP=0
Jun 13 11:45:21 linux-h3wk kernel: IPT FORWARD packet died: IN=eth1 OUT=eth2 SRC=192.168.163.67 DST=<cut> LEN=64 TOS=0x08 PREC=0x00 TTL=63 ID=25231 DF PROTO=TCP SPT=42140 DPT=59461 WINDOW=183 RES=0x00

�� passive ftp � iptables (aaa)

Fri, 13 Jun 2008 10:34:50 GMT

>[�� ]
> ;;
>'stop')
> ip_filter_stop
> ;;
>'restart')
> ip_filter_restart
> ;;
>*)
> echo "usage $0 start|stop|restart"
>esac

�� :
iptables -A FORWARD -p tcp -j LOG --log-level DEBUG --log-prefix "IPT FORWARD packet died: "
� ��

�� passive ftp � iptables (Alexander)

Fri, 13 Jun 2008 09:34:30 GMT

>�� -��? �� ?

�� , �� , ��, �� dir �� ls �� .
��, �� .
� �� iptables � �� FORWARD ��, �� ӣ �� .

�� passive ftp � iptables (skgennady)

Fri, 13 Jun 2008 09:28:52 GMT

>[�� ]
> ;;
>'stop')
> ip_filter_stop
> ;;
>'restart')
> ip_filter_restart
> ;;
>*)
> echo "usage $0 start|stop|restart"
>esac

�� -��? �� ?

OpenForum RSS: ��������� �������� � passive ftp � iptables

��������� �������� � passive ftp � iptables (OldDiesel)

��������� �������� � passive ftp � iptables (Alexander)

��������� �������� � passive ftp � iptables (skgennady)

��������� �������� � passive ftp � iptables (skgennady)

��������� �������� � passive ftp � iptables (Alexander)

��������� �������� � passive ftp � iptables (aaa)

��������� �������� � passive ftp � iptables (Alexander)

��������� �������� � passive ftp � iptables (skgennady)

OpenForum RSS: �� passive ftp � iptables

�� passive ftp � iptables (OldDiesel)

�� passive ftp � iptables (Alexander)

�� passive ftp � iptables (skgennady)

�� passive ftp � iptables (skgennady)

�� passive ftp � iptables (Alexander)

�� passive ftp � iptables (aaa)

�� passive ftp � iptables (Alexander)

�� passive ftp � iptables (skgennady)