Re: iptables rule to block FTP-NAT-Helper-Traffic

Kevin Kempfer a écrit :

Pascal Hambourg schrieb:

iptables -A FORWARD -i external_interface -m state --state RELATED \
-m helper ftp -j DROP

In order to be effective, this rule must be placed before the general "-m state ESTABLISHED,RELATED -j ACCEPT" rule.

Isn't this to be done on the router?

Yes.

As I don't have access to the router, I would like to secure my own machine against this attack.

Oh, I didn't understand that. Well, you can use this kind of rule in the INPUT chain of your local machine too, before the general state rule.

What I need is a rule which is running locally on my computer. Is there still a helper match?

This depends on your setup. "iptables -m helper -h" will tell if the match is supported by the installed iptables, and "grep MATCH_HELPER /boot/config-$(uname -r)" will tell if it is supported by the running kernel. The FTP conntrack helper module ip_contrack_ftp or nf_conntrack_ftp must be loaded. Actually, if the FTP conntrack helper module is not loaded on your local machine and the firewall drops incoming NEW connections, your machine is not at risk. Of course this means you cannot use FTP active mode either.
.

Relevant Pages

  • Re: NAT und PortForwarding 21
    ... braucht für aktives FTP einen "Helper", der mit einer wie auch immer ... Denn die Sicherheit, die ein Paketfilter umsetzt macht FTP ... Juergen P. Meier - "This World is about to be Destroyed!" ...
    (de.comp.security.misc)
  • Re: iptables rule to block FTP-NAT-Helper-Traffic
    ... As I wrote, the security problem happens only with FTP active mode, so you can block active mode data connections, which are incoming connections. ... You can identify packets related to the FTP conntrack/NAT helper with the "helper" match. ...
    (comp.os.linux.networking)
  • Re: [PATCH 2/3] IPVS: make friends with nf_conntrack
    ... xt_ipvs, to do source NAT, e.g.: ... How does IPVS interact with conntrack helpers? ... FTP is the only protocol helper in IPVS. ...
    (Linux-Kernel)
  • [PATCH] ipt_helper.c
    ... will match any packet from any helper other than FTP. ... send the line "unsubscribe linux-kernel" in ...
    (Linux-Kernel)
  • Re: Unable to read timestamp for remote files
    ... When I try to retrieve the timestamp from a ftp folder I get ... but the same works in my local machine. ... My motive is to read the timestamp for each files in the remote ...
    (perl.beginners)