Hi there,
I'm experiencing a strange problem when trying to FTP through a firewalling
bridge.
My FTP client connects to the FTP server ok. But when the client switches to
passive mode to get the directory's file list I get
stuck.
The bridge is running on a Debian Sarge box with kernel 2.6.8-3, iptables
1.2.11-10 and bridge-utils 1.0.4-1. The bridge is built from the physical
devices eth0 and eth1.
The bridge is assigned an IP address too to be able to manage it remotely.
Hence the INPUT and OUTPUT rules in my /etc/firewall.up.rules. As far as I
understood, iptables only uses the FORWARD chain for the bridged packets.
Here is my /etc/firewall.up.rules:
#
# is invoked by /etc/network/interfaces as pre-up for br0
#
*filter
#
:INPUT DROP [0:0]
# some input rules
#
:FORWARD DROP [0:0]
-A FORWARD -m state --state INVALID -j DROP
-A FORWARD -p icmp -j ACCEPT
# client to server
-A FORWARD -p tcp -s ! 217.17.69.18/255.255.255.224 --sport 1024:65535 \
-d 217.17.69.18/255.255.255.224 --dport 21 \
-m conntrack --ctstate NEW,RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -p tcp -s ! 217.17.69.18/255.255.255.224 --sport 1024:65535 \
-d 217.17.69.18/255.255.255.224 --dport 1024:65535 \
-m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
# server to client
-A FORWARD -p tcp -s 217.17.69.18/255.255.255.224 --sport 21 \
-d ! 217.17.69.18/255.255.255.224 --dport 1024:65535 \
-m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -p tcp -s 212.117.69.128/255.255.255.224 --sport 1024:65535 \
-d ! 217.17.69.18/255.255.255.224 --dport 1024:65535 \
-m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
# logging
-A FORWARD -j ULOG --ulog-nlgroup 1
#
:OUTPUT DROP [0:0]
# some output rules
#
COMMIT
#
These are all rules in the FORWARD chain. Using "! --syn" or "-m state --state
RELATED,ESTABLISHED" instead of "-m conntrack --ctstate RELATED,ESTABLISHED"
leads to the same result:
When I look into the logfile I find an entry where my client:somehighport tries
to tcp the server:somehighport. To me it looks like the client seems to want to
establish a data-connection and iptables does not recognize these packet as
RELATED or ESTABLISHED.
Just for the crack of it I temporarily added NEW to the second "client to
server"-rule. With that it works fine, but leaves the boxes behind the bridge
open for any attack on the high ports.
http, https or anything else is working properly, if I implement them in the
FORWARD chain.
Any suggestions out there?
bye and TIA
Jo
_______________________________________________________________
SMS schreiben mit WEB.DE FreeMail - einfach, schnell und
kostenguenstig. Jetzt gleich testen! http://f.web.de/?mc=021192
|