[SOLVED] allowing ftop out but not in

qwertyjjj · 08-09-2009, 04:14 PM

I want to allow ftp out but not in so I can send backups to another server.
Do I add this in the ouput part of iptables?
Is it only port 20 or do I need port 21 as well ?

Code:

*filter
:INPUT DROP [21:1032]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -d 88.xxx.xxx.xxx -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT
-A INPUT -d 88.xxx.xxx.xxx -p tcp -m tcp --dport 80 -m state --state NEW -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -m state --state NEW -j ACCEPT
-A INPUT -p udp -m udp --dport 53 -m state --state NEW -j ACCEPT
-A INPUT -p tcp -m tcp --dport 53 -m state --state NEW -j ACCEPT
-A INPUT -p udp -m udp --dport 123 -m state --state NEW -j ACCEPT
-A INPUT -p tcp -m tcp --dport 3306 -m state --state NEW -j ACCEPT
-A INPUT -p udp -m udp --dport 3306 -m state --state NEW -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5555 -m state --state NEW -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8002 -m state --state NEW -j ACCEPT
-A INPUT -p tcp -m tcp --dport 9001 -m state --state NEW -j ACCEPT
-A INPUT -p tcp -m state --state NEW,RELATED,ESTABLISHED -m tcp --dport 3128 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name SSH --rsource
-A INPUT -i eth0 -p tcp -m tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 8 --rttl --name SSH --rsource -j DROP
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
COMMIT

settntrenz · 08-10-2009, 12:33 AM

It depends if you will be using active or passive FTP. Using passive, it will work as configured. Using active, you will have to allow incoming connections from the FTP server.

The current configuration allows all outgoing traffic to pass based on the rule:
-A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT

http://slacksite.com/other/ftp.html has more details on FTP connections.

qwertyjjj · 08-10-2009, 02:54 AM

Quote:

Originally Posted by settntrenz

It depends if you will be using active or passive FTP. Using passive, it will work as configured. Using active, you will have to allow incoming connections from the FTP server.

The current configuration allows all outgoing traffic to pass based on the rule:
-A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT

http://slacksite.com/other/ftp.html has more details on FTP connections.

The default is usually passive though isn't it?

settntrenz · 08-10-2009, 11:58 AM

Quote:

Originally Posted by qwertyjjj

The default is usually passive though isn't it?

Yes.