Firewall problem

RouterOS Beginner Basics
1

Hi, i have RB450 v3.10 and configuradion is:

----{internet link}------[rb450 - NAT,FW,DHCP,DNS]---- [internal computers]

Problem is that I can’t access any FTP server on internet… here are my filter rules:

0 chain=forward action=accept src-address=10.10.10.0/24 protocol=icmp
1 chain=forward action=accept src-address=10.10.10.0/24 dst-port=80 protocol=tcp
2 chain=forward action=accept src-address=10.10.10.0/24 dst-port=110 protocol=tcp
3 chain=forward action=accept src-address=10.10.10.0/24 dst-port=25 protocol=tcp
4 chain=forward action=accept src-address=10.10.10.0/24 dst-port=1863 protocol=tcp
5 chain=forward action=accept src-address=10.10.10.0/24 dst-port=443 protocol=tcp
6 chain=forward action=accept src-address=10.10.10.0/24 dst-port=1723 protocol=tcp
7 chain=forward action=accept src-address=10.10.10.0/24 src-port=500 protocol=udp
8 chain=forward action=accept src-address=10.10.10.0/24 protocol=gre
9 chain=forward action=accept src-address=10.10.10.0/24 dst-port=3600 protocol=tcp
10 chain=forward action=accept src-address=10.10.10.0/24 src-port=1723 protocol=tcp
11 chain=forward action=accept src-address=10.10.10.0/24 dst-port=20-21 protocol=tcp
12 chain=forward action=drop src-address=10.10.10.0/24

Where am I wrong? Port 20-21 is accept but still I can’t access to ftp server on the internet but everything else is working ok.

Firewall and FTP
2

Hi,

You can’t connect to FTP server because this is Passive FTP.
In this case port 20 (data) is not used.
FTP server sends data via random unpriviledged port (1024-65535).
Your rule 12 drops this traffic, thats all.
Don’t block outgoing traffic, only incoming.

Regards, Grzegorz.

3

Hi,

Thanks for answering… but… I must block all outgoing traffic because I want to control what comes out of my network (some services will be forbidden) that’s why I must use rule 12.
Is there any other solution for my problem instead of disabilng rule 12?

4

Add a rule at the top of the forward chain that accepts all traffic with a connection-state of ‘related’ and ‘established’.

5

Hi fewi,

Thanks for answer… I first made a mistake but now that works… I must see what this rules exactly do because I have a lot of packets trough it but nobody is using FTP…

Once again - thanks a lot! :slight_smile:

6

I have one additional question, is possible log rule that drop everything (in my case rule 12)?
This will help me for troubleshooting if my FW dropping something what I want to let go out.

7

I done it also :slight_smile: I added rule ABOVE drop rule (rule 12):
add action=log chain=forward disabled=no log-prefix=FW-DROP src-address=10.10.10.0/24
and this log everything that goes into dropping rule 12 (now it’s rule 13).

If someone want to see what have I done I will post rules… just say…

8

Thanks for answer… I first made a mistake but now that works… I must see what this rules exactly do because I have a lot of packets trough it but nobody is using FTP…

The router knows if packets belong to a connection between two hosts. Those rules accept packets that belong to connections that the router knows about. All kinds of packets would match that, but only if you already permitted the very beginning of the connection explicitly earlier on. It doesn’t compromise safety, makes processing easier for the firewall (nearly all packets match very early in the ruleset and it can stop processing), and allows you to match packets in passive FTP connections because the router has a helper that can look inside the FTP control channel and determine what ports the data channel will use, and then allow them as a ‘related’ connection.

9

Fewi, thanks again… that was detailed explanation.