diff --git a/ip6t-firewall-server b/ip6t-firewall-server index ef7ba3e..2c60599 100755 --- a/ip6t-firewall-server +++ b/ip6t-firewall-server @@ -1333,7 +1333,7 @@ echononl "\t\tFTP Server (using CT target)" if [[ ${#ftp_server_ip_arr[@]} -gt 0 ]] || [[ ${#forward_ftp_server_ip_arr[@]} -gt 0 ]] ; then - # - Used for different ftpdata recent lists 'ftpdata_$i' + # - Used for different ftp6data recent lists 'ftp6data_$i' # - declare -i i=1 @@ -1355,27 +1355,27 @@ if [[ ${#ftp_server_ip_arr[@]} -gt 0 ]] || [[ ${#forward_ftp_server_ip_arr[@]} - # - ====================================================== # - # - Workaround: - # - (1) add source ip to a 'recent list' named 'ftpdata_$i! if ftp control connections appear - # - (2) accept packets of the formaly created recent list 'ftpdata_$i! + # - (1) add source ip to a 'recent list' named 'ftp6data_$i! if ftp control connections appear + # - (2) accept packets of the formaly created recent list 'ftp6data_$i! # - # ===== # - (1) # - - # - Accept initial FTP connection and add the source ip to ftpdata recent list 'ftpdata_$i'. + # - Accept initial FTP connection and add the source ip to ftpdata recent list 'ftp6data_$i'. # - - $ip6t -A INPUT -p tcp -m state --state NEW -d $_ip --dport 21 -m recent --name ftpdata_$i --set -j ACCEPT + $ip6t -A INPUT -p tcp -m state --state NEW -d $_ip --dport 21 -m recent --name ftp6data_$i --set -j ACCEPT # - (2) - # - - Accept packets if the source ip-address is in the 'ftpdata_$i' list (--update) and the + # - - Accept packets if the source ip-address is in the 'ftp6data_$i' list (--update) and the # - source ip-address was seen within the last 1800 seconds (--seconds 1800). # - # - - If matched, the "last seen" timestamp of the source address will be updated (--update). # - - # - - Entries in the ftpdata list not seen in the last 1800 will be removed (--reap). + # - - Entries in the ftp6data list not seen in the last 1800 will be removed (--reap). # - $ip6t -A INPUT -p tcp -m state --state NEW --sport 1024: -d $_ip --dport $ftp_passive_port_range \ - -m recent --name ftpdata_$i --update --seconds 1800 --reap -j ACCEPT + -m recent --name ftp6data_$i --update --seconds 1800 --reap -j ACCEPT # - Accept (helper ftp) related connections # - @@ -1396,29 +1396,29 @@ if [[ ${#ftp_server_ip_arr[@]} -gt 0 ]] || [[ ${#forward_ftp_server_ip_arr[@]} - # - ====================================================== # - # - Workaround: - # - (1) add source ip to a 'recent list' named 'ftpdata_$i! if ftp control connections appear - # - (2) accept packets of the formaly created recent list 'ftpdata_$i! + # - (1) add source ip to a 'recent list' named 'ftp6data_$i! if ftp control connections appear + # - (2) accept packets of the formaly created recent list 'ftp6data_$i! # - # ===== # - (1) # - - # - Accept initial FTP connection and add the source ip to ftpdata recent list 'ftpdata_$i'. + # - Accept initial FTP connection and add the source ip to ftpdata recent list 'ftp6data_$i'. # - - $ip6t -A FORWARD -p tcp -m state --state NEW -d $_ip --dport 21 -m recent --name ftpdata_$i --set -j ACCEPT + $ip6t -A FORWARD -p tcp -m state --state NEW -d $_ip --dport 21 -m recent --name ftp6data_$i --set -j ACCEPT # - (2) - # - - Accept packets if the source ip-address is in the 'ftpdata_$i' list (--update) and the + # - - Accept packets if the source ip-address is in the 'ftp6data_$i' list (--update) and the # - source ip-address was seen within the last 1800 seconds (--seconds 1800). # - # - - If matched, the "last seen" timestamp of the source address will be updated (--update). # - - # - - Entries in the ftpdata list not seen in the last 1800 will be removed (--reap). + # - - Entries in the ftp6data list not seen in the last 1800 will be removed (--reap). # - $ip6t -A FORWARD -p tcp -m state --state NEW --sport 1024: -d $_ip --dport $ftp_passive_port_range \ - -m recent --name ftpdata_$i --update --seconds 1800 --reap -j ACCEPT + -m recent --name ftp6data_$i --update --seconds 1800 --reap -j ACCEPT $ip6t -A FORWARD -p tcp -m state --state NEW --dport 1024: -s $_ip --sport $ftp_passive_port_range \ - -m recent --name ftpdata_$i --update --seconds 1800 --reap -j ACCEPT + -m recent --name ftp6data_$i --update --seconds 1800 --reap -j ACCEPT # - Accept (helper ftp) related connections # -