Jag kan inte få iptables att släppa igenom trafic för min ftp. Jag kör vsftpd med ssl. Någon som har något tips på vad jag kan testa ? Jag vet att det är något fel med iptables för det fungerar om jag väljer att släppa igenom allt på mitt ip.
vsftpd inställningar
Kod: Markera allt
listen=YES
anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
pasv_min_port=50505
pasv_max_port=50510
ftpd_banner=VÃkommen till min ftpserver
chroot_local_user=YES
ls_recurse_enable=YES
secure_chroot_dir=/var/run/vsftpd
pam_service_name=vsftpd
## SSL - krypterad trafik
ssl_enable=YES
force_local_logins_ssl=YES
force_local_data_ssl=YES
rsa_cert_file=/etc/ssl/vsftpd/vsftpd.pemKod: Markera allt
#!/bin/bash
# No spoofing
if [ -e /proc/sys/net/ipv4/conf/all/rp_filter ]
then
for filtre in /proc/sys/net/ipv4/conf/*/rp_filter
do
echo 1 > $filtre
done
fi
# No icmp
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
#load some modules you may need
modprobe ip_tables
modprobe ip_nat_ftp
modprobe ip_nat_irc
modprobe iptable_filter
modprobe iptable_nat
modprobe ip_conntrack_irc
modprobe ip_conntrack_ftp
modprobe nf_conntrack_ftp
modprobe nf_nat_ftp
# Remove all rules and chains
iptables -F
iptables -X
# Create chains
iptables -N FIREWALL
iptables -N TRUSTED
iptables -N ALLOWED_PORT
# first set the default behaviour => accept connections
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
# Send all INPUT packets to the FIREWALL chain
iptables -A INPUT -j FIREWALL
# DROP all forward packets, we don't share internet connection in this example
iptables -A FORWARD -j DROP
# FIREWALL Chain start _____________
# Allow ESTABLISHED and RELATED incoming connection
iptables -A FIREWALL -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
# Allow loopback traffic
iptables -A FIREWALL -i lo -j ACCEPT
# Send all packages to chains
iptables -A FIREWALL -j TRUSTED
iptables -A FIREWALL -j ALLOWED_PORT
# DROP all other packets
iptables -A FIREWALL -j DROP
# _____
# TRUSTED Chain start _____________
# VNC
iptables -A TRUSTED -i eth0 -s 192.168.0.2 -p tcp -m tcp --dport 5901 -j ACCEPT
# ____
# ALLOWED_PORT chain
# SSH
iptables -A ALLOWED_PORT -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT
# FTP
iptables -A ALLOWED_PORT -i eth0 -p tcp -m tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT
iptables -A ALLOWED_PORT -i eth0 -p tcp -m tcp --sport 20 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A ALLOWED_PORT -i eth0 -p tcp -m tcp --sport 1024:65535 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
# _____
# End message
echo " [End iptables rules setting]"
