Hi You should try and keep this on list Alex On Fri, Dec 05, 2008 at 02:17:42PM -0700, Robert L. Harris wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > > [snip] > > I've updated my rules to this: > # # allow ftpd > HARVARD="10.1.1.32" > /sbin/modprobe nf_conntrack_ftp > # General > iptables -I INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT > iptables -A INPUT -p tcp --dport 21 -m state --state NEW -j ACCEPT > iptables -A FORWARD -p tcp --dport 21 -m state --state NEW -j ACCEPT > iptables -t nat -A PREROUTING -p tcp --dport 21 -j DNAT --to > 10.1.1.32:21 > > I think I confused myself though, do I need the other rules I had for > port 20 or will the first INPUT rule > above cover that? have a look here http://slacksite.com/other/ftp.html (quick google on ftp & ports). It shows you how the ports are used for ftp. The ftp contrack module that you where loading previous should handle the "related" ports and allow them through, what I am not sure about is weather it will handle the dnat'ing of those port. But then again you could specify passive ftp only here is another link http://www.cyberciti.biz/faq/iptables-open-ftp-port-21/ (again google). My strength is in itables not ftp (which is the reason for googling :) ) Also anything to do with iptables and firewalls you should probably read a tutorial on iptables > > Thank you for your help, I've not done anything this complex with > iptables before. > > Robert > > > :wq! > ==================================================================== > Robert L. Harris | GPG Key ID: E344DA3B > @ x-hkp://pgp.mit.edu > DISCLAIMER: > These are MY OPINIONS With Dreams To Be A King, > ALONE. I speak for First One Should Be A Man > no-one else. - Manowar > > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.8 (Darwin) > > iD8DBQFJOZp28+1vMONE2jsRAgqcAJoD1OSBDcvPq2K7GL6Ym4xHBDRaNQCgo8WJ > ExmTlAt0/odRCTgtkimlF/E= > =TiTI > -----END PGP SIGNATURE----- > > -- "Obviously, I pray every day there's less casualty." - George W. Bush 04/11/2004 Fort Hood, TX
Attachment:
signature.asc
Description: Digital signature