Re: please help by iptables FORWARD...
Yes, I do. With FTP there is allways be a second ftp-data connection. By
default this should be on client(s) port 20 I.E. "-d 192.168.1.0/24
--dport 20", however it can be an arbitrary local port. With pasive FTP
this becomes an arbitrary remote port, not port 20. Insmod
ip_conntrack_ftp and then you should be able to use --state RELATED to
allow FTP to work.
--- trader <trade@shstahr.de> wrote:
> Hi Mike,
>
> thanks for your answer, i forward the port 53 for udp and it works fine,
> now
> i can set up all my needed ports like 21, 25, 110...
>
> another question,
>
> at the beginning, my FORWARD policie was ACCEPT and i closed the ports
> with
> the following commands:
>
> iptables -A FORWARD -s 192.168.1.0/24 -p tcp --dport 1:19 -j DROP
>
> the same for 22:24, 25:79, 81:109, 111:442, 444:65535
>
> with this setup i have problems with ftp, i can't get a "complete"
> connect
> to several servers, not all, mostly the connect freeze by "entering
> passive
> mode", than timeout...
>
> if i open the ports over 50000 than the connect works ok, the rest of
> services such as http/s , pop3, smtp... works fine.
>
> do you know this problem ?
>
> thanks for your help
>
> daniel
>
__________________________________
Do you Yahoo!?
Win a $20,000 Career Makeover at Yahoo! HotJobs
http://hotjobs.sweepstakes.yahoo.com/careermakeover
Reply to: