2

My IPTables rules are as follows:

# Generated by iptables-save v1.4.4 on Mon Aug 23 18:34:35 2010
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [9356:4246018]
-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 6685 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8000 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8089 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 20 -j ACCEPT
-A INPUT -j DROP
COMMIT

This is blocking FTP which I'm not sure why. FTP is indeed on port 21 as it as not been changed. I'm using VSFTPD. When I clear all IPTables rules I am able to use FTP just fine.

4
  • Have you tried using passive FTP?
    – PP.
    Aug 28, 2010 at 16:20
  • In the ubuntu guide it mentioned enabling passive FTP, but I couldn't do that because what it said to do wasn't there... now I can't find the guide...
    – Ben
    Aug 28, 2010 at 16:43
  • Are you sure this is a firewall problem, have you tried to turn it of for a few seconds and access your FTP server ? Also the rule -A INPUT -j DROP should come before the ftp rules.
    – Prix
    Aug 28, 2010 at 17:15
  • When I dump the rules, I can FTP just fine
    – Ben
    Aug 28, 2010 at 19:58

2 Answers 2

1

Have you loaded the ip_conntrack_ftp kernel module?

The ip_conntrack_ftp module "knows" about the ftp protocol and watches incoming connection to port 21 to work out what port the connection is going to use for data and then opens that port.

You don't need to use passive then.

However if you want to use passive, then that is nothing to do with vsftpd, that is a client side option.

I.e. the client user needs to set up his client to use passive mode.

3
  • Do I just need to load the module and it'll work or do I need to do anything else?
    – Ben
    Aug 28, 2010 at 19:57
  • @Webnet the related allow should take care of it, so it should just work
    – Joris
    Aug 28, 2010 at 20:21
  • Ohh, so you're saying that if I load this module I don't need to open IPTables, the ip_conntrack_ftp module opens them on IPTables when they're received?
    – Ben
    Aug 28, 2010 at 21:47
0

Throw in these lines, then check your syslog to see what traffic is being blocked:

-A INPUT -p tcp -m tcp --dport 20 -j LOG
-A INPUT -p tcp -m tcp --dport 21 -j LOG
-A OUTPUT -p tcp -m tcp --sport 20 -j LOG
-A OUTPUT -p tcp -m tcp --sport 21 -j LOG
2
  • I cleared syslog so I could see these errors easier. It appears it's not logging anything unless I'm not looking in the right place.
    – Ben
    Aug 28, 2010 at 16:39
  • Any ideas on where I can find these logs? If they are in syslog and I just can't find them, what should I be looking for specifically?
    – Ben
    Aug 31, 2010 at 15:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .