Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : FTP problem

[cannibal]

Hi

I don't know what is the problem on my server, no one from my clients can access FTP

they can access when I run

/sbin/iptables -F

but after hours from that the problem appear again

any one knows how can I fix it or any ideas !

thanks

cannibal

[wakkow]

What are your iptables entries before you flush it (or while ftp doesn't work)? Do a 'iptables -L'

[cannibal]

What this command will do

iptables -L

???

[wakkow]

From the man page:

       -L, --list [chain]
              List all rules in the selected chain.  If no chain is  selected,
              all  chains  are  listed.

It will list all the rules.. Since flushing the table fixes the problem, there must be an entry causing it.

[cannibal]

root@ns1 [~]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Chain FUDP (0 references)
target prot opt source destination

Chain LA (0 references)
target prot opt source destination

Chain LD (0 references)
target prot opt source destination

Chain PROHIBIT (0 references)
target prot opt source destination

Chain PZ (0 references)
target prot opt source destination

Chain RESET (0 references)
target prot opt source destination

Chain SSH_LOG (0 references)
target prot opt source destination

Chain TELNET_LOG (0 references)
target prot opt source destination

Chain acctboth (0 references)
target prot opt source destination

[wakkow]

Is that run when FTP works or when it's broken? There are no entries which would be the case if you ran "iptables -F" to flush it.

[cannibal]

that after FTP works I entered iptables -F before it

[cannibal]

I run iptables -L when it's broken

it shows like chacking IPs one by one not like the massege that I wrote up

any idea !

[wakkow]

To make sure I understand, it shows a listing of IP's? Do any of them say "DROP" in the first column? Any that say that means the firewall is droppnig those packets. You must have a saved entry in there that's causing the problem, but I'm not sure how it showed up in the first place or why it reoccurs.

You can try finding which entry is dropping packets to port 21, delete that entry and run 'iptables-save'.. It's hard to say without being on your machine.

[cannibal]

Yha

There are alot of DROP in the first column

how can I fix it ??

[cannibal]

from LogWatch

Dropped 417 packets on interface eth0

[zoomx]

How can I find which entry is dropping packets to port 21

and how can I delet it ??

[CArmstrong]

What distribution? If RedHat,

cat /etc/sysconfig/iptables

At least for me, that's the script that's imported into iptables on system startup. Post the contents of that and we can help you edit.

[cannibal]

Its RedHat Fedora

cat /etc/sysconfig/iptables

cat: /etc/sysconfig/iptables: No such file or directory

[wakkow]

If you run "iptables -F" to clear the firewall then "iptables-save" or "/sbin/service iptables save" to save the empty firewall.. I wouldn't recommend doing this since it will completely clear all your entries.. But you've already been running that way anyways.