[Zope] iptables locks out zope ftp

[Bryan Capitano]

Wow, that really seems like a hard way around the problem to me. Why mess
with the kernel modules? By removing kernel modules, (1)you run the risk of
crippling your iptables service (the service may tell you it's operational
but if a kernel module is out of place, your SOL and you won't even know it)
and (2)your changes will be lost when you reboot.

Adding the appropriate chain rules would be the "normal" way to modify
iptables. The following should be approximately sufficient for your problem
(in addition to your normal chain rules):

iptables -A INPUT -p all -i eth0 --dport 8021 -j ACCEPT
iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p tcp -m state --state ESTABLESHED,RELATED -j ACCEPT

I usually save all my rules to a shell script, run the script, then save the
"in-memory" rules like this:
`iptables-save > /etc/sysconfig/iptables`

restart the service:

`service iptables restart`

check your iptables to make sure they took effect:
`iptables -L`





Bryan R. Capitano
President,
CAPITANO WEb CONSULTING
Tel: 541-344-0747
Email: Bryan@capitanoweb.com
URL: http://www.capitanoweb.com

> -----Original Message-----
> From: zope-admin@zope.org [mailto:zope-admin@zope.org]On Behalf Of Roel
> Van den Bergh
> Sent: Wednesday, November 06, 2002 8:08 AM
> To: keo
> Cc: Zope Org; Tim p
> Subject: RE: [Zope] iptables locks out zope ftp
> Importance: High
>
>
> Thanks for the hint
>
> [root@piwebserver /]# lsmod | grep ip_conntrack_ftp
> ip_conntrack_ftp        5216   0  [ip_nat_ftp]
> ip_conntrack           22924   5  [ip_nat_ftp ip_conntrack_ftp ipt_state
> ip_conntrack_irc iptable_nat]
>
> Apparantly the order of doing things is very important
>
> [root@piwebserver /]# rmmod ip_nat_ftp
> [root@piwebserver /]# rmmod ip_conntrack_ftp
> [root@piwebserver /]# insmod ip_conntrack_ftp ports=21,8021
> Using
> /lib/modules/2.4.18-3smp/kernel/net/ipv4/netfilter/ip_conntrack_ftp.o
> [root@piwebserver /]# insmod ip_nat_ftp ports=21,8021
> Using /lib/modules/2.4.18-3smp/kernel/net/ipv4/netfilter/ip_nat_ftp.o
>
> Restarted ip_tables
> Launched a FTP session directly into Zope at 8021 and everything
> works fine
>
> > -----Oorspronkelijk bericht-----
> > Van: keo [mailto:keo@goa.hu]
> > Verzonden: zondag 3 november 2002 19:42
> > Aan: Roel Van den Bergh
> > Onderwerp: RE: [Zope] iptables locks out zope ftp
> >
> >
> > On Wed, 23 Oct 2002, Roel Van den Bergh wrote:
> >
> > > Thanks for the quick respond :-)
> > > Tried this first without succes
> > > # Load Modules
> > > /sbin/modprobe ip_tables
> > > /sbin/modprobe ip_conntrack
> > > /sbin/modprobe ip_nat_ftp ports=21,8021
> > > /sbin/modprobe ip_conntrack_ftp ports=21,8021
> > > /sbin/modprobe ip_conntrack_irc
> > >
> > > Then tried the following:
> > >
> > > [root@server sbin]# rmmod ip_nat_ftp
> > > [root@server sbin]# insmod ip_nat_ftp ports=21,8021
> > >
> > > worked fine
> > >
> > > but I do not seem to be able to do the same with ip_conntrack_ftp
> > >
> > > [root@server sbin]# rmmod ip_conntrack_ftp
> > > ip_conntrack_ftp: Device or resource busy
> >
> > seems some other module is using it. what does lsmod say?
> >
> > for me lsmod says for example:
> >
> > ip_conntrack           12684   5  (autoclean) [ip_conntrack_irc
> > ip_conntrack_ftp ip_nat_ftp ipt_MASQUERADE iptable_nat]
> >
> > which means ip_conntrack is used by 5 modules (ip_conntrack_irc
> > ip_conntrack_ftp ip_nat_ftp ipt_MASQUERADE iptable_nat)
> >
> > if lsmod | grep ip_conntrack_ftp says:
> >
> >  ip_conntrack_ftp        3200   0  (unused)
> >
> > then its unused, and some other thing may be there.
> >
> > perhaps if you have an active connection, which uses ip_conntrack_ftp it
> > wont let it be removed. check with lsof, for example, what is
> using which
> > file , device, or port.
> >
> > (lsof=list open files)
> >
> > keo
> > --
> > don't believe everything you think
> >
> >
> >
>
>
>
> _______________________________________________
> Zope maillist  -  Zope@zope.org
> http://lists.zope.org/mailman/listinfo/zope
> **   No cross posts or HTML encoding!  **
> (Related lists -
>  http://lists.zope.org/mailman/listinfo/zope-announce
>  http://lists.zope.org/mailman/listinfo/zope-dev )
>