Urgent Help: Need to Restrict Ftp on WAN Allow only on LAN

[kavirajan]

Hi Friends,

We are using Centos 6, in our system two Ethernet Cards are used one for LAN Access and another one for WAN internet.
We are used for Appache server, for showing demo site to clients.

So I need to give Restrict permission for the following.
1. Restrict FTP access on internet WAN. Only LAN users can use FTP.
2. In internet users (client) can only view Http site. Ftp should restricted on internet.

Please anyone Help me. Its very Urgent.

[Irithori]

The easiest solution is to configure, on which interfaces the http/ftp daemons listen.
In apache, this is how it´s done:
mpm_common - Apache HTTP Server

[tdsan]

Hi Friends,

We are using Centos 6, in our system two Ethernet Cards are used one for LAN Access and another one for WAN internet.
We are used for Appache server, for showing demo site to clients.

So I need to give Restrict permission for the following.
1. Restrict FTP access on internet WAN. Only LAN users can use FTP.
2. In internet users (client) can only view Http site. Ftp should restricted on internet.

Please anyone Help me. Its very Urgent.

=========================================

This is Tdsan, you might want to try this.

ex - 10.10.10.0/24 - Please use your own ip subnet address

Use this code to address the ftp issue

iptables -I INPUT 1 -p tcp -s 10.10.10.0/24 -m multiport --dport 21 -m state --state NEW -i eth0 -j ACCEPT

Use this code to address the html issue, allows users from the internet to connect to the server from external connect (i.e. 192.168.1.10 - web server)

iptables -I INPUT 2 -p tcp -d 192.168.1.10 -m multiport --dport 80 -m state --state NEW -i eth1 -j ACCEPT
iptables -I INPUT 3 -p tcp -d 192.168.1.0/24 -m multiport 21 -i eth1 -j DROP

[ss81]

#This will block ACCESS TO FTP FROM OUTSIDE WORLD
iptables -I INPUT -i <WAN-Interface-name> -p tcp --dport 20 -j DROP
iptables -I INPUT -i <WAN-Interface-name> -p tcp --dport 21 -j DROP

# TO ALLOW ONLY WEB ACCESS FROM OUTSIDE WORLD
iptables -I INPUT -i <WAN-Interface-name> -p tcp --dport 80 -j ACCEPT

[kavirajan]

Thanks for the replies.


________________________________________
thekavirajan.blogspot.com