ip_masq_ftp and ipchains

ip_masq_ftp and ipchains

Post by Sneaky Pengui » Tue, 25 Dec 2001 21:21:01



I have a question (or two) about the issue relating to ftp traffic through a
Linux ipchains firewall.

I've noticed that Windoze clients have problems with ftping through an
ipchains firewall
with the return traffic from a target ftp server.  i.e  Windoze connects to
an ftp server just fine,
but the return traffic doesn't get back to the client.  I've researched this
problem on the net,
and have seen reference to ip_masq_ftp.

I've also noticed that at least Linux clients (maybe others) don't suffer
this problem.

My first question is about why the Windoze clients have this trouble - why
is that?  What does
the Windoze ftp client do differently than a Linux ftp client?

Secondly, after searching for ip_masq_ftp, I've come up with nothing.  It's
not on my system anywhere.
I do however see a module called ip_nat_ftp, but when I try to load it in my
firewall script with
"modprobe ip_nat_ftp" I get the following errors:

/lib/modules/2.4.7-10/kernel/net/ipv4/netfilter/ip_conntrack.o: init_module:
Device or resource busy

Hint: insmod errors can be caused by incorrect module parameters, including
invalid IO or IRQ parameters

/lib/modules/2.4.7-10/kernel/net/ipv4/netfilter/ip_conntrack.o: insmod
/lib/modules/2.4.7-10/kernel/net/ipv4/netfilter/ip_conntrack.o failed

/lib/modules/2.4.7-10/kernel/net/ipv4/netfilter/ip_conntrack.o: insmod
ip_nat_ftp failed

What is wrong with the "modprobe ip_nat_ftp" command?

ip_masq_ftp seems to be an ipchains module - and not for iptables.  Is this
correct?  If so, must I now
employ iptables (and different modules) to fix the Windoze ftp problem?

Thanks for any help!

Regards - and Happy Holidays!

-Craig

 
 
 

ip_masq_ftp and ipchains

Post by Dean Thompso » Tue, 25 Dec 2001 23:12:07


Hi!,


> I have a question (or two) about the issue relating to ftp traffic through
> a Linux ipchains firewall.

> I've noticed that Windoze clients have problems with ftping through an
> ipchains firewall with the return traffic from a target ftp server.  i.e  
> Windoze connects to an ftp server just fine, but the return traffic doesn't
> get back to the client.  I've researched this problem on the net, and have
> seen reference to ip_masq_ftp.

> I've also noticed that at least Linux clients (maybe others) don't suffer
> this problem.

> My first question is about why the Windoze clients have this trouble - why
> is that?  What does the Windoze ftp client do differently than a Linux ftp
> client?

I suspect it is a case of the ftp client not entering into a "passive" mode.
Check to see whether the "passive" mode is supported on your Windows ftp
client.

- Show quoted text -

Quote:

> Secondly, after searching for ip_masq_ftp, I've come up with nothing.  It's
> not on my system anywhere. I do however see a module called ip_nat_ftp, but
> when I try to load it in my firewall script with
> "modprobe ip_nat_ftp" I get the following errors:

> /lib/modules/2.4.7-10/kernel/net/ipv4/netfilter/ip_conntrack.o:
> init_module: Device or resource busy

> Hint: insmod errors can be caused by incorrect module parameters, including
> invalid IO or IRQ parameters

> /lib/modules/2.4.7-10/kernel/net/ipv4/netfilter/ip_conntrack.o: insmod
> /lib/modules/2.4.7-10/kernel/net/ipv4/netfilter/ip_conntrack.o failed
> /lib/modules/2.4.7-10/kernel/net/ipv4/netfilter/ip_conntrack.o: insmod
> ip_nat_ftp failed

> What is wrong with the "modprobe ip_nat_ftp" command?

Okay, you will need to remove the ipchains module which is probably loaded on
your system in the first place.  Issue the command: /sbin/rmmod ipchains, and
then try the other commands and see whether you get any more success.

Quote:> ip_masq_ftp seems to be an ipchains module - and not for iptables.  Is this
> correct?  If so, must I now employ iptables (and different modules) to fix
> the Windoze ftp problem?

Use the modules you mentioned above, but specifically:

/sbin/insmod iptable_nat
/sbin/insmod ip_nat_ftp
/sbin/insmod ip_conntrack
/sbin/insmod ip_conntrack_ftp

See ya

Dean Thompson

--
+____________________________+____________________________________________+

| Bach. Computing (Hons)     | ICQ     - 45191180                         |
| PhD Student                | Office  - <Off-Campus>                     |
| School Comp.Sci & Soft.Eng | Phone   - +61 3 9903 2787 (Gen. Office)    |
| MONASH (Caulfield Campus)  | Fax     - +61 3 9903 1077                  |
| Melbourne, Australia       |                                            |
+----------------------------+--------------------------------------------+

 
 
 

ip_masq_ftp and ipchains

Post by Bernd Eckenfel » Wed, 26 Dec 2001 01:30:32



> I've also noticed that at least Linux clients (maybe others) don't suffer
> this problem.

Most likely it is not the Linux/Windows differene, but the diference between
active and pasive FTP.

Greetings
Bernd

 
 
 

1. Help: ipchains and FTP problem (ip_masq_ftp IS installed)

Hi,

I'm running RedHat 6 on a small network. I have configured the linux box to
run as "internet gateway" for a Windows98 system.

When I try to connect to my newly acquired domain through FTP from Win98, I
can connect just fine, but I can't get the directory listing (it says it
can't connect to my PPP client-side ip and port). I have tried forcing the
FTP app to passive mode with no success.

If I connect directly from the linux, then there's no problem.

All other FTP sites I have tried works just fine. Both anonymous login and
my personal account at my ISP.

Some relevant configurations:

Linux IP: 192.168.0.20
Win98 IP: 192.168.0.21

rc.local:
modprobe ip_masq_ftp.o
ipchains -P forward DENY
ipchains -A forward -s 192.168.0.0/24 -j MASQ
echo 1 > /proc/sys/net/ipv4/ip_dynaddr

I have read several postings and documents mentioning something about
accepting inbound packets. I have tried numerous combinations of ipchains
.-A input etc., but I can't get it to work. Please note that I'm far from
being an expert in this area, so any suggestions are more than welcome!

Thanks!
--
Best regards
Sebastian Bargmann

2. ksame scores?

3. ipchains, RH 7.2 et ip_masq_ftp

4. Setting up DIP with a Netcom Account

5. Matrox Mystique ands X.

6. Doc's about gdk?

7. kernel 2.2.3 ip_masq_ftp.o missing

8. SCSI Problem - adding CDRW after install

9. IP Masquerading and ip_masq_ftp patches

10. why the 'ip_masq_ftp.o' is not in the RedHat 7.1 ?

11. ip_masq_ftp

12. Missing ip_masq_ftp