Mailinglist Archive: opensuse (2575 mails)

["LLLActive@xxxxxxx" <LLLActive@xxxxxxx>]

Hi all,

Config: NO SUSEfirewall2 in use. IPTables are in a script and loaded with "bash 
rules.sh"

I got active FTP going (Ports 20 & 21), but as soon as I logged in on 
an external FTP server and want to list the directory, I have no
response. I have gathered that the problem is with the passice FTP mode
it switches to. How do I cater for passive FTP with an IPTABLES command.
The active command in a rules.sh script is:

~~~~~~~  START (part of rules.sh script) ~~~~~~~~~~

#### variables #####

# net all
NET_ALL='0.0.0.0/0'

# external interface
IF_EXT='eth0'
IP_EXT='10.9.8.1'
NET_EXT='10.9.8.0/24'
BCAST_EXT='10.9.8.255'

# internal interface
IF_INT='eth1'
IP_INT='10.8.0.1'
NET_INT='10.8.0.0/24'
BCAST_INT='10.8.0.255'

......

# ports
p_high='1024:65535'
plist_ftp='20 21'

......

# FTP
for p_ftp in $plist_ftp; do
        # use these rules for every port in $plist_ftp
        iptables -A FORWARD -i $IF_INT -o $IF_EXT -p TCP -s $NET_INT -d 
$NET_ALL --sport $p_high --dport $p_ftp -m state --state NEW,ESTABLISHED -j 
ACCEPT
        iptables -A FORWARD -i $IF_EXT -o $IF_INT -p TCP -s $NET_ALL -d 
$NET_INT --sport $p_ftp --dport $p_high -m state --state ESTABLISHED -j ACCEPT
done

~~~~~~ END ~~~~~~

I have seen references to loading the kernel modules ip_conntrack_ftp and 
ip_nat_ftp. Because I do not use SUSEfirewall2, the modules ip_conntrack_ftp 
and ip_nat_ftp does not load it seems. I do not find any trace of them because 
a with 'modprobe -v ip_conntrack_ftp' or a 'modprobe -v ip_nat_ftp' I get no 
response or verbose output. 

With "/sbin/insmod ip_conntrack_ftp" I get:
insmod: can't read 'ip_conntrack_ftp': No such file or directory

I have done YaST searches on all available repos, rpm searches and oggoled; to 
no avail. Where do I get these modules for OpenSUSE 10.3? 

TIA
Al


-- 
To unsubscribe, e-mail: opensuse+unsubscribe@xxxxxxxxxxxx
For additional commands, e-mail: opensuse+help@xxxxxxxxxxxx