Yes, I added the rule to log and accept all source port 20 traffic but I
can't see any log message about ftp-data in log and I don't have any
similar message to "kernel: conntrack_ftp: partial PORT...." in kernel
logs.
If I capture with tcpdump at ftp server and firewall interfaces, I see
incorrect checksum entries when a net ftp client try to do a data
transfer in active mode.
Finally I've found that if I unload nf_nat_ftp and nf_conntrack_ftp
modules, active ftp mode works fine (but not passive).
Gabriel.
On Thu, 2010-04-15 at 06:46 -0700, Tom Eastep wrote:
> Gabriel Gonzalez Cano wrote:
> > Yes, I read that howto before posting here, but I can't see what I'm
> > doing wrong with the rules configuration, any help is welcome.
>
> The article describes using the debugging features of ftp to see what is
> going wrong; have you done that? If so, what were the results? If not,
> why not?
>
> The article describes kernel log messages reporting that a partial PORT
> or PASV reply has been received; have you looked for those? Note that
> there is also a suggested additional rule in the event that you are
> seeing those messages. Have you found any such messages? If so, did you
> try applying the fix?
>
> -Tom
> --
> Tom Eastep \ When I die, I want to go like my Grandfather who
> Shoreline, \ died peacefully in his sleep. Not screaming like
> Washington, USA \ all of the passengers in his car
> http://shorewall.net \________________________________________________
>
> ------------------------------------------------------------------------------
> Download Intel® Parallel Studio Eval
> Try the new software tools for yourself. Speed compiling, find bugs
> proactively, and fine-tune applications for parallel performance.
> See why Intel Parallel Studio got high marks during beta.
> http://p.sf.net/sfu/intel-sw-dev
> _______________________________________________
> Shorewall-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/shorewall-users
>
--
Aquest missatge ha estat analitzat per MailScanner
a la cerca de virus i d'altres continguts perillosos,
i es considera que està net.
------------------------------------------------------------------------------
Download Intel® Parallel Studio Eval
Try the new software tools for yourself. Speed compiling, find bugs
proactively, and fine-tune applications for parallel performance.
See why Intel Parallel Studio got high marks during beta.
http://p.sf.net/sfu/intel-sw-dev
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users
