movEAX_444
02-28-2004, 03:40 PM
This is the setup I want: Allow connections to port 21, running proFTPd, on my ftp I want all read-only directories except for one upload folder. How do I allow this?
right now, this is my iptables firewall, I can recv and send DCC files, and I can host an Unreal server (game) on port 7777..
#!/bin/sh
# Simple $IPTABLES based firewall script
#
# Anything-goes on local network
# Local can connect to anywhere on the internet
# Only accept connections to ident, FTP and Xchat DCC
#
#
# Some variables
IPTABLES='/usr/sbin/iptables'
MODPROBE='/sbin/modprobe'
IDENT_PORT=113
FTP_PORT=21
DCC_PORT_RANGE=5000:5010
LAN_RANGE=192.168.1.0/24
if [ "$1" = 'reset' ]
then
echo -n \* Restoring iptables default settings...
$IPTABLES -F
$IPTABLES -X
$IPTABLES -P INPUT ACCEPT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD DROP
echo success
exit 0
fi
# Load modules
$MODPROBE ipt_conntrack
$MODPROBE ipt_state
# Flush chains
$IPTABLES -F
# Clear any previously user-defined chains
$IPTABLES -X
# Default policy for each chain
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P FORWARD DROP
# User-defined chains
$IPTABLES -N allowed
$IPTABLES -N TCP_chain
$IPTABLES -N UDP_chain
$IPTABLES -N ICMP_chain
# Rules for allowed user-defined chain
$IPTABLES -A allowed -p TCP --syn -j ACCEPT
$IPTABLES -A allowed -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A allowed -p TCP -j DROP
# Rules for TCP user-defined chain
$IPTABLES -A TCP_chain -p TCP --dport $IDENT_PORT -j allowed
$IPTABLES -A TCP_chain -p TCP --dport $FTP_PORT -j allowed
$IPTABLES -A TCP_chain -p TCP --dport $DCC_PORT_RANGE -j allowed
# Rules for UDP user-defined chain
$IPTABLES -A UDP_chain -p UDP --dport 7777 -j ACCEPT
# Rules for ICMP user-defined chain
$IPTABLES -A ICMP_chain -p ICMP --icmp-type 8 -j DROP # Don't allow pings
$IPTABLES -A ICMP_chain -p ICMP --icmp-type 0 -j ACCEPT # Accept reply if we sent a ping
# Error messages to accept
$IPTABLES -A ICMP_chain -p ICMP --icmp-type 3 -j ACCEPT
$IPTABLES -A ICMP_chain -p ICMP --icmp-type 11 -j ACCEPT
$IPTABLES -A ICMP_chain -p ICMP -j DROP
# INPUT chain
# Rules for LAN
$IPTABLES -A INPUT -p ALL -d localhost -j ACCEPT
$IPTABLES -A INPUT -p ALL -d 192.168.1.6 -j ACCEPT
# Rules for packets coming from the internet
$IPTABLES -A INPUT -p ALL -d My_internet_ip -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -p TCP -j TCP_chain
$IPTABLES -A INPUT -p UDP -j UDP_chain
$IPTABLES -A INPUT -p ICMP -j ICMP_chain
# OUTPUT chain
# Allow anything from me to me
$IPTABLES -A OUTPUT -p ALL -s localhost -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $LAN_RANGE -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s My_internet_ip -j ACCEPT
I can connect to the ftp server but typing 'ls' or 'dir' just times out..
Another question, how do I kick/ban someone who is downloading from my ftp?
right now, this is my iptables firewall, I can recv and send DCC files, and I can host an Unreal server (game) on port 7777..
#!/bin/sh
# Simple $IPTABLES based firewall script
#
# Anything-goes on local network
# Local can connect to anywhere on the internet
# Only accept connections to ident, FTP and Xchat DCC
#
#
# Some variables
IPTABLES='/usr/sbin/iptables'
MODPROBE='/sbin/modprobe'
IDENT_PORT=113
FTP_PORT=21
DCC_PORT_RANGE=5000:5010
LAN_RANGE=192.168.1.0/24
if [ "$1" = 'reset' ]
then
echo -n \* Restoring iptables default settings...
$IPTABLES -F
$IPTABLES -X
$IPTABLES -P INPUT ACCEPT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD DROP
echo success
exit 0
fi
# Load modules
$MODPROBE ipt_conntrack
$MODPROBE ipt_state
# Flush chains
$IPTABLES -F
# Clear any previously user-defined chains
$IPTABLES -X
# Default policy for each chain
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P FORWARD DROP
# User-defined chains
$IPTABLES -N allowed
$IPTABLES -N TCP_chain
$IPTABLES -N UDP_chain
$IPTABLES -N ICMP_chain
# Rules for allowed user-defined chain
$IPTABLES -A allowed -p TCP --syn -j ACCEPT
$IPTABLES -A allowed -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A allowed -p TCP -j DROP
# Rules for TCP user-defined chain
$IPTABLES -A TCP_chain -p TCP --dport $IDENT_PORT -j allowed
$IPTABLES -A TCP_chain -p TCP --dport $FTP_PORT -j allowed
$IPTABLES -A TCP_chain -p TCP --dport $DCC_PORT_RANGE -j allowed
# Rules for UDP user-defined chain
$IPTABLES -A UDP_chain -p UDP --dport 7777 -j ACCEPT
# Rules for ICMP user-defined chain
$IPTABLES -A ICMP_chain -p ICMP --icmp-type 8 -j DROP # Don't allow pings
$IPTABLES -A ICMP_chain -p ICMP --icmp-type 0 -j ACCEPT # Accept reply if we sent a ping
# Error messages to accept
$IPTABLES -A ICMP_chain -p ICMP --icmp-type 3 -j ACCEPT
$IPTABLES -A ICMP_chain -p ICMP --icmp-type 11 -j ACCEPT
$IPTABLES -A ICMP_chain -p ICMP -j DROP
# INPUT chain
# Rules for LAN
$IPTABLES -A INPUT -p ALL -d localhost -j ACCEPT
$IPTABLES -A INPUT -p ALL -d 192.168.1.6 -j ACCEPT
# Rules for packets coming from the internet
$IPTABLES -A INPUT -p ALL -d My_internet_ip -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -p TCP -j TCP_chain
$IPTABLES -A INPUT -p UDP -j UDP_chain
$IPTABLES -A INPUT -p ICMP -j ICMP_chain
# OUTPUT chain
# Allow anything from me to me
$IPTABLES -A OUTPUT -p ALL -s localhost -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $LAN_RANGE -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s My_internet_ip -j ACCEPT
I can connect to the ftp server but typing 'ls' or 'dir' just times out..
Another question, how do I kick/ban someone who is downloading from my ftp?