IPTABLES下FT.P的问题.
用AS4.做了一个代理服务器,所有的内网机器通过这台LI.NUX机器访问外网,上面做了IPTABLES,打开了常用的端口如20,21,23等,其它端口被禁止来限止其它应用,但现在设了后内网机器无法正常访问.FTP服务器,请指点该如何解决!以下为IPTABLE.S内容 女人
[root@mack2050 ~.]# ipt.ables-save--- 印刷
# Generated by iptables-sa.ve v1.3.7 on Tue May 15 17:11:01. 2007投资
*nat
REROUTING ACCEPT [4049976:318497068]http://upload.bbs.csuboy.com/Mon_1004/126_6747_e3d115ab71927ac.gif[/img].
OSTROUTING ACCEPT [289961:29518591]http://upload.bbs.csuboy.com/Mon_1004/126_6747_e3d115ab71927ac.gif[/img](广告)
:OUT.PUT ACCEPT [10357.:503162]域名
-A PREROUTING -i ppp0 -p udp -m u.dp --dport 7324 -j DNAT --t.o-destination 192.168..1.86:7324 .
-A PREROUTING -i ppp0 -p tcp -m tcp --dport 7324. -j DNAT --to-destination 192.168.1..86:.7324 服务器
-A. PREROUTING -i ppp0 -p udp -m udp --dport 146.72 -j DNA.T --to-destination 192.168.1.86:14672 .
-A PREROUTING -i ppp0 -p. tcp -m tcp --dport 146.62 -j DNAT --to-destination 192.168..1.86:14662 虚拟主机
-A PREROUTING -i ppp.0 -p tcp -m tcp --dport 8.015 -j DNAT --to-destination .192.168.1.15:80 女人
-A PREROUTING -i ppp0 -p tcp -m. tcp --dport 3000 -j DNAT --to-destination 192.168.1..15:30.00 外贸
-A PREROUTING -i ppp0 -p tcp -m tc.p --dport 3001 -.j DNAT --to-destination 192.168.1..15:3001 婚庆
-A PREROUTING -i ppp0 -.p tcp -m .tcp --dport 8016 -.j DNAT --to-destination 192.168.1.16:80 电子
-A PREROUTING -i ppp0 -p tcp -m tcp -.-dport 30.03. -j DNAT --to-destination 192.168.1.16:3003 --- 印刷
-A PREROUTING -i ppp0 -p .tcp -m tcp --dport 3002 -j DNAT .--to-destination 192.168.1.16:3002 . 健康
-A PREROUTING -i ppp0 -p tcp -m tcp --.dport 888 -.j DNAT --to-des.tination 192.168.1.2:80
-A. PRER.OUTING -i ppp0 -p tcp -m tcp --dport 8888 -j DNAT --to-destination .192.168.1.86:3389 学习
-A POSTROUTING -o ppp0 -j MASQUERAD.E. 杀毒
COMMIT
# Comple.ted on Tue May 15. 17:11:01 2007健康
# Generated by iptable.s.-save v1.3.7 on Tue May 15 17:11:01 2007.
*filter
:INPUT DROP [939724:.9514.3669] 婚庆
:FORWARD DROP [1928590:11.54.89809] 健康
:OUTPUT ACCEPT [47003:4.0.17498] 建材
-A. INPUT -i eth0 -j ACCE.PT .
-A. INPUT -p tcp -m multiport --dports .22,23,6160 -j ACCEPT .
-A INPUT -p icmp -m icmp .--icmp-type an.y -j ACCEPT 健康
-A INPUT .-m state --state RELATED,ESTABLISH.ED -j ACCEPT 电影
-A FORWAR.D -p tcp. -m multiport --dports 135,137,138,139,445 -j DROP 域名
-A FORWARD. -p udp -m multiport --dpo.rts 135,137,138,139,445 -j DROP 乙肝
-A FORWARD -m. iprange --src-range 192.168.1.82-192.168.1.90 -j ACCEP.T (广告)
-A FORW..ARD -m iprange --dst-range 192.168.1.82-192.168.1.90 -j ACCEPT 教育
-A FORWARD. -m iprange --dst-range 192.168.1.15-192.168.1.16 -.j ACCEPT 婚庆
-A .FORWARD -p icmp -m icmp --icmp-type an.y -j ACCEPT 外贸
-A FORWAR.D -p tcp -m multiport --dports 53,20,21,80,443,444,119,110,25,161,22,2.3,91,6911,3004 -j ACC.EPT 投资
-A. FORWARD -p udp -m multiport --dports 5.3,123,8000 -j ACCEPT 健康
-A FORWARD -m state --state. RELATED,ESTAB.LISHED -j ACCEPT .
-A FORWARD -p tcp -m multiport --s.ports .20,21,23,443,444 -j ACCEPT [成人用品]
-A FORWARD -s 192...168.1.244 -j ACCEPT 汽车
COMMIT
在没有做限制的IP上能用.被动模式访问无法用主动模式访问,做了限制的机器被动模式也无.法访问,被动模式应该.是FTP服务器提供一个随机的端口给客户端,再建立一个新的连接来传送数据,这种情况下有什么办法可以实现吗?电影
