modules/ferm/manifests/ftp_conntrack.pp

   1 class ferm::ftp_conntrack {
   2         # This also works for jessie hosts, but requires a reboot
   3         if (versioncmp($::lsbmajdistrelease, '9') >= 0) {
   4                 # Allow non-passive connections to an FTP server
   5                 ferm::rule { 'dsa-ftp-conntrack-client':
   6                         domain      => '(ip ip6)',
   7                         description => 'ftp client connection tracking',
   8                         table       => 'raw',
   9                         chain       => 'OUTPUT',
  10                         rule        => 'proto tcp dport 21 CT helper ftp'
  11                 }
  12
  13                 # Allow passive connections from an FTP client
  14                 ferm::rule { 'dsa-ftp-conntrack-server':
  15                         domain      => '(ip ip6)',
  16                         description => 'ftp server connection tracking',
  17                         table       => 'raw',
  18                         chain       => 'PREROUTING',
  19                         rule        => 'proto tcp dport 21 CT helper ftp'
  20                 }
  21         } else {
  22                 ferm::module { 'nf_conntrack_ftp': }
  23         }
  24 }