|
Iptables Tutorial 1.2.2Complex protocols support Protocol name Kernel versions FTP 2.3 IRC 2.3 TFTP 2.5 Amanda 2.5 • FTP • IRC • TFTP Let's take the FTP protocol as the first example. The FTP protocol first opens up a single connection that is called the FTP control session. When we issue commands through this session, other ports are opened to carry the rest of the data related to that specific command. These connections can be done in two ways, either actively or passively. When a connection is done actively, the FTP client sends the server a port and IP address to connect to. After this, the FTP client opens up the port and the server connects to that specified port from a random unprivileged port (>1024) and sends the data over it. The problem here is that the firewall will not know about these extra connections, since they were negotiated within the actual payload of the protocol data. Because of this, the firewall will be unable to know that it should let the server connect to the client over these specific ports. The solution to this problem is to add a special helper to the connection tracking module which will scan through the data in the control connection for specific syntaxes and information ...» | Код для вставки книги в блог HTML
phpBB
текст
|
|