1

I have an iptables firewall running on a Fedora Linux server that is basically being used as a firewall router and OpenVPN server. That's it. We have been using the same iptables firewall code for YEARS. I did make some changes on 21 December to re-route a mySQL port, but given what has happened I've completely backed those changes out. Sometime after those changes were made and backed out passive FTP, served from a vsftpd process, stopped working. We use a passive ftp client to FLING (that's the name of the ftp client running under Windows! :-) ) images from our remote telescopes to our server.

I believe it is something in the firewall code because I can drop the firewall and the FTP file transfer (and connecting to the ftp site with Internet Explorer to see the file list) works. When I raise the iptables firewall, it stops working.

Again, this is code that we'd been using for years. However, I felt that maybe there was something I missed, so we had a .bak file from 2009 that I used. Same behavior, passive ftp does not work.

So, I went and rebuilt the firewall code line by line to see what line was causing the problem. Everything worked until I put the line

-A FORWARD -j DROP

in very near the end. Of course, if I am correct, this is the line that basically "turns on" the firewall, saying drop everything except for the exceptions I've made above. However, this line has been in the iptables code probably since 2003.

So, I'm at the end of my rope, and I still can't figure out why this has stopped working. I guess I need an expert on iptables configuration.

Here is the iptables code (from iptables-save) with comments.

# Generated by iptables-save v1.3.8 on Thu Jan  5 18:36:25 2012
*nat
# One of the things that I remain ignorant about is what these following three lines
# do in both the nat tables (which we're not using on this machine) and the following
# filter table.  I don't know what the numbers are, but I'm ASSUMING they're port
# ranges.
#
:PREROUTING ACCEPT [7435:551429]
:POSTROUTING ACCEPT [6097:354458]
:OUTPUT ACCEPT [5:451]
COMMIT
# Completed on Thu Jan  5 18:36:25 2012
# Generated by iptables-save v1.3.8 on Thu Jan  5 18:36:25 2012
*filter
:INPUT ACCEPT [10423:1046501]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [15184:16948770]

# The following line is for my OpenVPN configuration.
-A INPUT -i tun+ -j ACCEPT 

# In researching this on the Internet I found some iptables code that was supposed to
# open the needed ports up. I never needed this before this week, but since passive FTP
# was no longer working, I decided to put the code in. The next three lines are part of
# that code.
-A INPUT -p tcp -m tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT 
-A INPUT -p tcp -m tcp --sport 1024:65535 --dport 20 -m state --state ESTABLISHED -j ACCEPT 
-A INPUT -p tcp -m tcp --sport 1024:65535 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT 

# Another line for the OpenVPN configuration. I don't know why the iptables-save mixed
# the lines up.
-A FORWARD -i tun+ -j ACCEPT 

# Various forwards for all our services
-A FORWARD -s 65.118.148.197 -p tcp -m tcp --dport 3307 -j ACCEPT 
-A FORWARD -d 65.118.148.197 -p tcp -m tcp --dport 3307 -j ACCEPT 
-A FORWARD -s 65.118.148.197 -p tcp -m tcp --dport 3306 -j ACCEPT 
-A FORWARD -d 65.118.148.197 -p tcp -m tcp --dport 3306 -j ACCEPT 
-A FORWARD -s 65.118.148.196 -p tcp -m tcp --dport 21 -j ACCEPT 
-A FORWARD -d 65.118.148.196 -p tcp -m tcp --dport 21 -j ACCEPT 
-A FORWARD -d 65.118.148.196 -p tcp -m tcp --dport 20 -j ACCEPT 
-A FORWARD -s 65.118.148.196 -p tcp -m tcp --dport 20 -j ACCEPT 
-A FORWARD -s 65.118.148.196 -p tcp -m tcp --dport 7191 -j ACCEPT 
-A FORWARD -d 65.118.148.196 -p tcp -m tcp --dport 7191 -j ACCEPT 
-A FORWARD -s 65.118.148.196 -p tcp -m tcp --dport 46000:46999 -j ACCEPT 
-A FORWARD -d 65.118.148.196 -p tcp -m tcp --dport 46000:46999 -j ACCEPT 
-A FORWARD -s 65.118.148.0/255.255.255.0 -j ACCEPT 
-A FORWARD -d 65.118.148.196 -p udp -m udp --dport 53 -j ACCEPT 
-A FORWARD -s 65.118.148.196 -p udp -m udp --dport 53 -j ACCEPT 
-A FORWARD -d 65.118.148.196 -p tcp -m tcp --dport 53 -j ACCEPT 
-A FORWARD -s 65.118.148.196 -p tcp -m tcp --dport 53 -j ACCEPT 
-A FORWARD -d 65.118.148.196 -p udp -m udp --dport 25 -j ACCEPT 
-A FORWARD -s 65.118.148.196 -p udp -m udp --dport 25 -j ACCEPT 
-A FORWARD -d 65.118.148.196 -p tcp -m tcp --dport 42 -j ACCEPT 
-A FORWARD -s 65.118.148.196 -p tcp -m tcp --dport 42 -j ACCEPT 
-A FORWARD -s 65.118.148.196 -p tcp -m tcp --dport 25 -j ACCEPT 
-A FORWARD -d 65.118.148.196 -p tcp -m tcp --dport 25 -j ACCEPT 
-A FORWARD -d 65.118.148.196 -p tcp -m tcp --dport 80 -j ACCEPT 
-A FORWARD -s 65.118.148.196 -p tcp -m tcp --dport 80 -j ACCEPT 
-A FORWARD -d 65.118.148.204 -p tcp -m tcp --dport 80 -j ACCEPT 
-A FORWARD -s 65.118.148.204 -p tcp -m tcp --dport 80 -j ACCEPT 
-A FORWARD -d 65.118.148.196 -p tcp -m tcp --dport 6667 -j ACCEPT 
-A FORWARD -s 65.118.148.196 -p tcp -m tcp --dport 6667 -j ACCEPT 
-A FORWARD -s 65.96.214.242 -p tcp -m tcp --dport 22 -j ACCEPT 
-A FORWARD -s 192.68.148.66 -p tcp -m tcp --dport 22 -j ACCEPT 
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 

# "The line" that causes passive ftp to stop working. Insofar as I can tell, everything
# else seems to work - ssh, telnet, mysql, httpd.
-A FORWARD -j DROP 
-A FORWARD -p icmp -j ACCEPT 

# The following code is again part of my attempt to put in code that would cause passive
# ftp to work. I don't know why iptables-save scattered it about like this.
-A OUTPUT -p tcp -m tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT 
-A OUTPUT -p tcp -m tcp --sport 20 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A OUTPUT -p tcp -m tcp --sport 1024:65535 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT 
COMMIT
# Completed on Thu Jan  5 18:36:25 2012

So, with all that prelude, my basic question is: How can I get passive ftp to work behind an iptables firewall? As you can see, I've tried to get it working (again) and tried to do some research on the issue, but have come up...short.

Any answers would be appreciated by both me and various variable star astronomers around the world! THANKS!

-Richard "Doc" Kinne, American Assoc. of Variable Star Observers, [email protected]

1
  • 2
    Is nf_conntrack_ftp or ip_conntrack_ftp in lsmod(8) output?
    – sarnold
    Jan 6, 2012 at 0:41

3 Answers 3

1

The easiest option is to configure vsftpd with a range of ports to use for PASV connections (using pasv_max_port and pasv_min_port), and then allow all incoming connections in that port range through the firewall.

0

Looking at your iptables rules, I am assuming that it is your intention to forward your FTP traffic to host 65.118.148.196 - I am also assuming that 65.118.148.196 is not the host where your iptables are running.

For iptables to successfully forward PASV FTP traffic in this way, the iptables conntrack module must be loaded.

To do so, modify your /etc/sysconfig/iptables-config file. The first few lines should look like this:

# Load additional iptables modules (nat helpers)
#   Default: -none-
# Space separated list of nat helpers (e.g. 'ip_nat_ftp ip_nat_irc'), which
# are loaded after the firewall rules are applied. Options for the helpers are
# stored in /etc/modprobe.conf.
IPTABLES_MODULES=""

Update the space labeled IPTABLES_MODULES="" to the following: IPTABLES_MODULES="ip_conntrack_ftp". It is possible to load these modules as part of a rule using the -m conntrack flag, doing it that way can lead to the module being flushed when the rule is restarted. This would be consistent with the behavior you described in your post. Configuring the modules in the way I have outlined above would load the modules with iptables, instead of a specific rule. After updating /etc/sysconfig/iptables-config you will need to restart the iptables service.

To provide you with exactly the correct iptables rules, we would need to know the exact port range your FTP server is configured to use for PASV.

-2

My IP tables is pretty rusty, but if the issue starts once you tell the firewall to only allow explicitly defined connections, then it seems like the connection you're trying to establish isn't defined properly by your rules. Are you sure both your client and server are attempting to use the same port?

Also, while IP tables is a very powerful firewall, it is not the most user-friendly. Perhaps it's time to consider new software.

You must log in to answer this question.