pacman passive ftp with iptables..

cactus · 2004-05-28 02:19:19

I thought someone might find this useful.

I generally use a rather restrictive permission set for iptables. I have default policies on input chains set to deny. I had forgotten how to allow passive ftp stuff through (ie pacman), so I just looked it up. That of course, helped me recall..

So, my iptables.save looks like..

*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
COMMIT

Maybe someone will find this useful.

i3839 · 2004-05-28 10:26:23

To get normal ftp working in a safe way you can enable the ftp conntrack module (same for other things like IRC). Of course there's nothing wrong with using passive ftp.

cactus · 2004-05-28 16:36:36

I actually prefer passive. the server tells the client which port to connect on, so the client opens the second connection (data connection) based on info recieved from the first connection (control connection).

In Active ftp the client tells the server which high number port to use, and the server initiates the second connection to the client...active ftp is a horrible protocol..

i3839 · 2004-05-28 18:21:06

Normal ftp is a horrible protocol too . But yes, passive ftp should be the default.

cactus · 2004-05-28 19:35:14

i3839 wrote:

Normal ftp is a horrible protocol too .

So very true.
8)

Arch Linux

#1 2004-05-28 02:19:19

pacman passive ftp with iptables..

#2 2004-05-28 10:26:23

Re: pacman passive ftp with iptables..

#3 2004-05-28 16:36:36

Re: pacman passive ftp with iptables..

#4 2004-05-28 18:21:06

Re: pacman passive ftp with iptables..

#5 2004-05-28 19:35:14

Re: pacman passive ftp with iptables..

Board footer