iptables rule to block FTP-NAT-Helper-Traffic

Hi everybody,

I just got aware of the FTP-NAT-Helper security problem. Here's what happens:

- I visit a page with a hostile java applet
- the applet calls home with what seems to be a legitimate FTP session
- the remote server responds with "sure, I'll send that data on port 5900" (which just happens to be the standard VNC port)
- the router opens port 5900 for that remote host to this local host, and that remote host now has access to a local port that it should not.

(dicussed here: http://www.linksysinfo.org/forums/showthread.php?t=54999)


Is there a way to block this kind of traffic? I tried some standard linux firewall GUIs (firestarter, gufw, guarddog) but none of them produced rules that block the evil traffic. Tested it using http://bedatec.dyndns.org/ftpnat/test.html

It still shows open ports which should not be reachable from outside my network.

What can I do to block that traffic?

Thanks,

Kevin
.

Relevant Pages

  • RE: SSH port forwarding not working?
    ... Assume that you have user 'vncuser' on a remote host, ... -L sets up a dummy listening port on localhost,which in this case 5801, ... I seem to encrypt the session it doesn't work. ... The Gartner Group just put Neoteris in the top of its Magic Quadrant, ...
    (Security-Basics)
  • Python socket wont connect on Windows
    ... On the remote host in a LAN there is a server listening on port 2020. ... Python 2.6.2 on Linux 2.6.31-rc3 on the server side ... Using alternative software on the client side. ...
    (comp.lang.python)
  • Re: Oracle 9i - Putty - tnsping works - connection does not!
    ... is local host, ... no conceivable circumstances in which lo0 adapter could be on a remote ... Mission of such configuration is ... To your connections on local TCP port 1500, ...
    (comp.databases.oracle.server)
  • Re: Socket recv(1) seems to block instead of returning end of file.
    ... No. recvworks fine for me (Python 2.4 under Gentoo). ... HOST = 'Linuxbox' # Symbolic name meaning the local host ... PORT = 57001 # Arbitrary non-privileged port ... if 'timed out' in msg: ...
    (comp.lang.python)
  • Re: SSH through wireless router
    ... $ ssh localhost ... Connection closed by remote host ... When I went to sshd to port 2222: ... debug1: read PEM private key done: type RSA ...
    (Debian-User)
Quantcast