Re: iptables rule to block FTP-NAT-Helper-Traffic

Hello,

Pascal Hambourg schrieb:
- I visit a page with a hostile java applet

Here is the actual security problem.

which I have in mind, but I cannot stop all users on my network to use java.

Is there a way to block this kind of traffic?

Sure. As I wrote, the security problem happens only with FTP active mode, so you can block active mode data connections, which are incoming connections. You can identify packets related to the FTP conntrack/NAT helper with the "helper" match.

iptables -A FORWARD -i external_interface -m state --state RELATED \
-m helper ftp -j DROP

In order to be effective, this rule must be placed before the general "-m state ESTABLISHED,RELATED -j ACCEPT" rule.

Isn't this to be done on the router? As I don't have access to the router, I would like to secure my own machine against this attack. What I need is a rule which is running locally on my computer. Is there still a helper match?

Anyway, is this really efficient ? Couldn't the hostile applet just connect locally to the VNC port and relay the communication with the hostile server ?

Sure, it could, but it isn't as trivial as it is now ;)

Thank you!

Kevin
.

Relevant Pages

  • Re: FTP error using a MAC
    ... Yes, you are using active mode, but the firewall/NAT can't take care of it ... behind a firewall, you then told me to change to active mode? ... In active mode the FTP client connects from a random unprivileged port N ...
    (microsoft.public.inetserver.iis.ftp)
  • RE: ftp trouble (3) - routing?
    ... > I'm still having problems with vsftpd and FC2. ... Perhaps your smoothwall is not set up to proxy active mode FTP. ... Traceroute to your FTP gives a response from D-Link with address ...
    (Fedora)
  • Re: FTP error using a MAC
    ... If we switch to active mode then the port command fails as the IP address issued is the local IP associated with the miniMac running behind a firewall, the same firewall as the windows PC; ... attempting to FTP to a Microsoft Windows 2003 FTP Server ...
    (microsoft.public.inetserver.iis.ftp)
  • Active mode FTP over PPP
    ... with "Active mode" FTP over a serial PPP link. ... I'm running a SuSE Enterprise 9 server with pppd version ... All machines can see each other and I can FTP using active and passive ... Error message generated when trying to "ls" on connection to Server ...
    (comp.os.linux.setup)
  • Re: Internet Explorer can not access FTP of IIS6.0 behind ISA
    ... I have tried to set in active mode in IE. ... On IIS I have set up a FTP Site with the isolated user Mode. ... It seems that the FTP Client from Internet ...
    (microsoft.public.inetserver.iis.ftp)