[x]
Posted via EE Mobile

Search, ask, and monitor your questions on the go with EE Mobile. Visit Experts Exchange from your mobile device and never be out of touch again.
Question
[x]
Attachment Details
[x]
The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

  • The Grade of the Solution
  • The Zone Rank of the Expert Providing the Solution
  • The Number of Author and Expert Comments
  • The Number of Experts Contributing
  • The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!
6.2

ip tables script won't let ftp traffic through

Asked by adamshields in Linux Network Security

Tags: accept, inetin, iptables

I have no idea what i'm missing, everything works fine except ftp whether it's explorer or a ftp client

# Generated by iptables-save v1.2.8 on Tue Jun 14 00:12:20 2005
*filter
:INPUT DROP [26:1940]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [16:4188]
:DMZIN - [0:0]
:DMZOUT - [0:0]
:INETIN - [0:0]
:INETOUT - [0:0]
:LDROP - [0:0]
:LREJECT - [0:0]
:LTREJECT - [0:0]
:TCPACCEPT - [0:0]
:TREJECT - [0:0]
:UDPACCEPT - [0:0]
:ULDROP - [0:0]
:ULREJECT - [0:0]
:ULTREJECT - [0:0]
-A INPUT -i eth1 -j INETIN
-A INPUT -s 192.168.0.0/255.255.255.0 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A FORWARD -i eth1 -o eth0 -j INETIN
-A FORWARD -i eth0 -o eth1 -j INETOUT
-A FORWARD -s 192.168.0.0/255.255.255.0 -i ! eth1 -o ! eth1 -j ACCEPT
-A OUTPUT -o eth1 -j INETOUT
-A INETIN -m state --state INVALID -j DROP
-A INETIN -p icmp -m icmp --icmp-type 5 -j TREJECT
-A INETIN -p icmp -m icmp --icmp-type 9 -j TREJECT
-A INETIN -p icmp -m icmp --icmp-type 10 -j TREJECT
-A INETIN -p icmp -m icmp --icmp-type 15 -j TREJECT
-A INETIN -p icmp -m icmp --icmp-type 16 -j TREJECT
-A INETIN -p icmp -m icmp --icmp-type 17 -j TREJECT
-A INETIN -p icmp -m icmp --icmp-type 18 -j TREJECT
-A INETIN -p icmp -m icmp --icmp-type 8 -m limit --limit 1/sec -j ACCEPT
-A INETIN -p icmp -m icmp --icmp-type 8 -j TREJECT
-A INETIN -p icmp -m icmp ! --icmp-type 8 -j ACCEPT
-A INETIN -p tcp -m tcp --dport 20 -j TCPACCEPT
-A INETIN -p tcp -m tcp --dport 21 -j TCPACCEPT
-A INETIN -p tcp -m tcp --dport 22 -j TCPACCEPT
-A INETIN -p tcp -m tcp --dport 25 -j TCPACCEPT
-A INETIN -p tcp -m tcp --dport 53 -j TCPACCEPT
-A INETIN -p tcp -m tcp --dport 80 -j TCPACCEPT
-A INETIN -p tcp -m tcp --dport 110 -j TCPACCEPT
-A INETIN -p tcp -m tcp --dport 139 -j TCPACCEPT
-A INETIN -p tcp -m tcp --dport 143 -j TCPACCEPT
-A INETIN -p tcp -m tcp --dport 445 -j TCPACCEPT
-A INETIN -p tcp -m tcp --dport 465 -j TCPACCEPT
-A INETIN -p tcp -m tcp --dport 587 -j TCPACCEPT
-A INETIN -p tcp -m tcp --dport 873 -j TCPACCEPT
-A INETIN -p tcp -m tcp --dport 953 -j TCPACCEPT
-A INETIN -p tcp -m tcp --dport 993 -j TCPACCEPT
-A INETIN -p tcp -m tcp --dport 2401 -j TCPACCEPT
-A INETIN -p tcp -m tcp --dport 2402 -j TCPACCEPT
-A INETIN -p tcp -m tcp --dport 3128 -j TCPACCEPT
-A INETIN -p tcp -m tcp --dport 10000 -j TCPACCEPT
-A INETIN -p udp -m udp --dport 20 -j UDPACCEPT
-A INETIN -p udp -m udp --dport 21 -j UDPACCEPT
-A INETIN -p udp -m udp --dport 53 -j UDPACCEPT
-A INETIN -p udp -m udp --dport 137 -j UDPACCEPT
-A INETIN -p udp -m udp --dport 138 -j UDPACCEPT
-A INETIN -m state --state ESTABLISHED -j ACCEPT
-A INETIN -p tcp -m tcp --dport 1024:65535 -m state --state RELATED -j TCPACCEPT
-A INETIN -p udp -m udp --dport 1024:65535 -m state --state RELATED -j UDPACCEPT
-A INETIN -j TREJECT
-A INETOUT -j ACCEPT
-A LDROP -p tcp -m limit --limit 2/sec -j LOG --log-prefix "TCP Dropped " --log-level info
-A LDROP -p udp -m limit --limit 2/sec -j LOG --log-prefix "UDP Dropped " --log-level info
-A LDROP -p icmp -m limit --limit 2/sec -j LOG --log-prefix "ICMP Dropped " --log-level info
-A LDROP -f -m limit --limit 2/sec -j LOG --log-prefix "FRAGMENT Dropped "
-A LDROP -j DROP
-A LREJECT -p tcp -m limit --limit 2/sec -j LOG --log-prefix "TCP Rejected " --log-level info
-A LREJECT -p udp -m limit --limit 2/sec -j LOG --log-prefix "UDP Rejected " --log-level info
-A LREJECT -p icmp -m limit --limit 2/sec -j LOG --log-prefix "ICMP Rejected " --log-level info
-A LREJECT -f -m limit --limit 2/sec -j LOG --log-prefix "FRAGMENT Rejected "
-A LREJECT -j REJECT --reject-with icmp-port-unreachable
-A LTREJECT -p tcp -m limit --limit 2/sec -j LOG --log-prefix "TCP Rejected " --log-level info
-A LTREJECT -p udp -m limit --limit 2/sec -j LOG --log-prefix "UDP Rejected " --log-level info
-A LTREJECT -p icmp -m limit --limit 2/sec -j LOG --log-prefix "ICMP Rejected " --log-level info
-A LTREJECT -f -m limit --limit 2/sec -j LOG --log-prefix "FRAGMENT Rejected "
-A LTREJECT -j TREJECT
-A TCPACCEPT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -m limit --limit 30/sec -j ACCEPT
-A TCPACCEPT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -m limit --limit 2/sec -j LOG --log-prefix "Possible SynFlood "
-A TCPACCEPT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j TREJECT
-A TCPACCEPT -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -j ACCEPT
-A TCPACCEPT -m limit --limit 2/sec -j LOG --log-prefix "Mismatch in TCPACCEPT "
-A TCPACCEPT -j TREJECT
-A TREJECT -p tcp -j REJECT --reject-with tcp-reset
-A TREJECT -p udp -j REJECT --reject-with icmp-port-unreachable
-A TREJECT -p icmp -j DROP
-A TREJECT -j REJECT --reject-with icmp-port-unreachable
-A UDPACCEPT -p udp -j ACCEPT
-A UDPACCEPT -m limit --limit 2/sec -j LOG --log-prefix "Mismatch on UDPACCEPT "
-A UDPACCEPT -j TREJECT
-A ULDROP -p tcp -m limit --limit 2/sec -j ULOG --ulog-prefix "LDROP_TCP"
-A ULDROP -p udp -m limit --limit 2/sec -j ULOG --ulog-prefix "LDROP_UDP"
-A ULDROP -p icmp -m limit --limit 2/sec -j ULOG --ulog-prefix "LDROP_ICMP"
-A ULDROP -f -m limit --limit 2/sec -j ULOG --ulog-prefix "LDROP_FRAG"
-A ULDROP -j DROP
-A ULREJECT -p tcp -m limit --limit 2/sec -j ULOG --ulog-prefix "LREJECT_TCP"
-A ULREJECT -p udp -m limit --limit 2/sec -j ULOG --ulog-prefix "LREJECT_UDP"
-A ULREJECT -p icmp -m limit --limit 2/sec -j ULOG --ulog-prefix "LREJECT_UDP"
-A ULREJECT -f -m limit --limit 2/sec -j ULOG --ulog-prefix "LREJECT_FRAG"
-A ULREJECT -j REJECT --reject-with icmp-port-unreachable
-A ULTREJECT -p tcp -m limit --limit 2/sec -j ULOG --ulog-prefix "LTREJECT_TCP"
-A ULTREJECT -p udp -m limit --limit 2/sec -j ULOG --ulog-prefix "LTREJECT_UDP"
-A ULTREJECT -p icmp -m limit --limit 2/sec -j ULOG --ulog-prefix "LTREJECT_ICMP"
-A ULTREJECT -f -m limit --limit 2/sec -j ULOG --ulog-prefix "LTREJECT_FRAG"
-A ULTREJECT -p tcp -j REJECT --reject-with tcp-reset
-A ULTREJECT -p udp -j REJECT --reject-with icmp-port-unreachable
-A ULTREJECT -p icmp -j DROP
-A ULTREJECT -j REJECT --reject-with icmp-port-unreachable
COMMIT
# Completed on Tue Jun 14 00:12:20 2005
# Generated by iptables-save v1.2.8 on Tue Jun 14 00:12:20 2005
*nat
:PREROUTING ACCEPT [56:3174]
:POSTROUTING ACCEPT [7:600]
:OUTPUT ACCEPT [5:520]
COMMIT
# Completed on Tue Jun 14 00:12:20 2005
# Generated by iptables-save v1.2.8 on Tue Jun 14 00:12:20 2005
*mangle
:PREROUTING ACCEPT [623:74973]
:INPUT ACCEPT [1200:139905]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [626:294533]
:POSTROUTING ACCEPT [1312:340402]
COMMIT
# Completed on Tue Jun 14 00:12:20 2005

 
Related Solutions
Keywords: ip tables script won't let ftp traffic thr…
Title
1 iptables
2 config to alow browser ftp out to inter…
3 IPtables Redirection
4 iptables help!!
5 IPTABLES logging...
6 IPTABLES + SQUID
 
Loading Advertisement...
 
[+][-]06/13/05 09:23 PM, ID: 14208771Author Comment

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 30-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]06/15/05 02:41 AM, ID: 14219140Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]06/15/05 12:30 PM, ID: 14224990Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]06/17/05 03:52 AM, ID: 14239275Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]06/17/05 03:54 AM, ID: 14239291Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]06/17/05 09:08 AM, ID: 14242412Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]06/17/05 08:05 PM, ID: 14246844Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]06/20/05 07:47 AM, ID: 14257161Author Comment

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 30-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]06/20/05 08:02 AM, ID: 14257294Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]07/03/05 02:19 PM, ID: 14358900Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]07/03/05 11:48 PM, ID: 14360261Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]07/18/05 07:03 AM, ID: 14466209Author Comment

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 30-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]07/18/05 07:18 AM, ID: 14466362Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]07/20/05 08:30 AM, ID: 14485705Author Comment

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 30-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]07/21/05 12:16 AM, ID: 14491804Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]07/21/05 11:13 AM, ID: 14495621Author Comment

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 30-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]07/21/05 11:09 PM, ID: 14500035Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]07/22/05 08:17 AM, ID: 14503409Author Comment

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 30-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]07/22/05 08:49 AM, ID: 14503804Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]07/24/05 11:23 PM, ID: 14516211Accepted Solution

View this solution now by starting your 30-day free trial. Setting up your free trial is quick, easy, and secure. We will return you to this solution, unlocked, when you're done.

About this solution

Zone: Linux Network Security
Tags: accept, inetin, iptables
Sign Up Now!
Solution Provided By: XoF
Participating Experts: 7
Solution Grade: A
 
 
Loading Advertisement...
20091111-EE-VQP-89