0

I use this iptables config It simply redirect to port 21 the connection of 2121(used to run ftp as user instead of root)

  *nat
    :PREROUTING ACCEPT [200:39210]
    :INPUT ACCEPT [6:360]
    :OUTPUT ACCEPT [21:1323]
    :POSTROUTING ACCEPT [21:1323]
    -A PREROUTING -i eth0 -p tcp -m tcp --dport 2121 -j DNAT --to-destination 192.168.0.2:21
    COMMIT
    # Completed on Sun Jan 24 19:17:55 2016
    # Generated by iptables-save v1.4.20 on Sun Jan 24 19:17:55 2016
    *filter
    :INPUT ACCEPT [0:0]
    :FORWARD ACCEPT [0:0]
    :OUTPUT ACCEPT [2996:188699]
    -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
    -A INPUT -p icmp -j ACCEPT
    -A INPUT -i lo -j ACCEPT
    -A INPUT -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT
    -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
    -A INPUT -p tcp -m state --state NEW -m tcp --dport 2121 -j ACCEPT
    -A INPUT -j REJECT --reject-with icmp-host-prohibited
    -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
    -A FORWARD -p icmp -j ACCEPT
    -A FORWARD -i lo -j ACCEPT
    -A FORWARD -d 192.168.0.2/32 -i eth0 -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT
    -A FORWARD -j REJECT --reject-with icmp-host-prohibited
    COMMIT
    # Completed on Sun Jan 24 19:17:55 2016

ip4 forwarding is enabled This config works perfect on two virtual machines: one slackware,one centos6 But not my host with slackware. What can i check? I forgot: the server ftp is on a chroot

5
  • Which IP address did you use for the host rule? – Kdecherf Jan 24 '16 at 21:51
  • Same ip,i use same ip because i want to run ftp as user not as root,and user cannot use 21 wich is privileged port – elbarna Jan 25 '16 at 0:42
  • What is sysctl net.bridge.bridge-nf-call-iptables returning on the host? – Kdecherf Jan 25 '16 at 10:44
  • By the way if your server listens on port 2121 you should reverse ports of your PREROUTING rule – Kdecherf Jan 25 '16 at 10:47
  • This configuration works fine,but not when is in chroot – elbarna Jan 25 '16 at 15:56
0

Solution finally found. ftp is on chroot,and is pure-ftpd This line

Bind                      10.2.2.1,2121

Don't work on chroot,but work out of chroot

This line

Bind                      *,2121

Works perfect in chroot

I use this firewall script

iptables -A INPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT  -p tcp --sport 20 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 20 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT  -p tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT  -p tcp --sport 2121 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 2121 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -t nat -A PREROUTING -s 192.168.0.0/24 -m tcp -p tcp --dport 21 -j REDIRECT --to-port 2121
iptables -t nat -A OUTPUT -s 192.168.0.0/24 -m tcp -p tcp -o lo --dport 21 -j REDIRECT --to-port 2121

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.