John Leach's Blog » tls http://johnleach.co.uk/words Stuff I think, see and do Fri, 18 Jun 2010 22:57:41 +0000 en hourly 1 http://wordpress.org/?v=3.0.1 netfilter ip_conntrack_ftp and tls http://johnleach.co.uk/words/archives/2005/12/07/197/netfilter-ip_conntrack_ftp-and-tls http://johnleach.co.uk/words/archives/2005/12/07/197/netfilter-ip_conntrack_ftp-and-tls#comments Wed, 07 Dec 2005 16:06:28 +0000 john http://johnleach.co.uk/words/archives/2005/12/07/197/ Here I am attempting to connect to a server using lftp wondering why the firewall is blocking the incoming data connections, even though ip_conntrack_ftp has been working for years.

lftp supports tls, and so does the server I’m connecting to. This means the control connection is encrypted, so the netfilter ftp connection tracker can’t peek inside the packets to find out which ports to open up to allow the data connections. DUH. Ftp sucks.

Anyway, the only way I found to disable tls support in lftp is to add the following line to ~/.lftp/rc:

set ftp:ssl-allow false
]]> http://johnleach.co.uk/words/archives/2005/12/07/197/netfilter-ip_conntrack_ftp-and-tls/feed 2