[Shorewall-users] setting up passive ftp

Tom Eastep
2002-10-09T16:10:18Z

mark field wrote:
> shorewall-users,
>
>   i have shorewall running fine on my linux router gateway at home,
>   but i have an ftp server running on a none standard port (2112)and am
>   having trouble setting up the firewall to allow passive connections,
>   from what i have read i need to set it to use connection tracking on
>   the odd port, after read the mailing list archive i have altered /
>   added the folllowing files as follows
>
>   /etc/shorewall/rules    added
>
>   ACCEPT          loc       fw            tcp     2112
>   ACCEPT          net       fw            tcp     2112
>
>
>   /etc/shorewall/modules  altered as below
>
>     loadmodule ip_tables
>     loadmodule iptable_filter
>     loadmodule ip_conntrack
>     loadmodule ip_conntrack_ftp ports=21,2112
>     loadmodule ip_conntrack_irc
>     loadmodule iptable_nat
>     loadmodule ip_nat_ftp ports=21,2112
>     loadmodule ip_nat_irc
>
>
>   /etc/modules.conf   added to bottom
>
>   options ip_nat_ftp ports=21,2112
>   options ip_conntrack_ftp ports=21,2112
>
>   is this correct as passive connection still hang
>

Looks ok -- did you unload and reload the ftp netfilter modules after you
made those changes?

-Tom
--
Tom Eastep    \ Shorewall - iptables made easy
AIM: tmeastep  \ http://www.shorewall.net
ICQ: #60745924  \ teastep@shorewall.net