When iptables is started, there is no ftp access because of timeout

Question

When I start the iptables service, there is no ftp access because of a connection timeout. When I stop the iptables service, ftp works fine.

This is the current iptables data:

Update: replaced ESTABLISHED for NEW in p21 rule. The problem is still happening.

# Generated by iptables-save v1.4.7 on Sun Dec 14 23:48:26 2014
*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [4:2848]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP 
-A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP 
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP 
-A INPUT -i lo -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT 
-A INPUT -p tcp -m tcp --sport 21 -m state --state NEW -j ACCEPT 
-A INPUT -p tcp -m tcp --sport 20 -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -p tcp -m tcp --sport 1024:65535 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT 
-A OUTPUT -p tcp -m tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT 
-A OUTPUT -p tcp -m tcp --dport 20 -m state --state ESTABLISHED -j ACCEPT 
-A OUTPUT -p tcp -m tcp --sport 1024:65535 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT 
COMMIT
# Completed on Sun Dec 14 23:48:26 2014

Could any of these lines causing this strange behavior?

-A INPUT -p tcp -m tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT 
-A INPUT -p tcp -m tcp --sport 20 -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -p tcp -m tcp --sport 1024:65535 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT 
-A OUTPUT -p tcp -m tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT 
-A OUTPUT -p tcp -m tcp --dport 20 -m state --state ESTABLISHED -j ACCEPT 
-A OUTPUT -p tcp -m tcp --sport 1024:65535 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -

I've tried connecting to the ftp server in both passive and active modes.

Answer 1

Typically where you have

-A INPUT -p tcp -m tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT 

On a FTP server I would expect

-A INPUT -p tcp -m tcp --dport 21 -m state --state NEW -j ACCEPT 

to accept incoming FTP connections, which are NEW, as existing connections are already accepted by an earlier rule.

Second you'll need to ensure the FTP connection tracking module is enabled. Offhand : insmod nf_conntrack_ftp and made persistent by:

# /etc/sysconfig/iptables-config 
# Space separated list of nat helpers (e.g. 'ip_nat_ftp ip_nat_irc'), which
# are loaded after the firewall rules are applied. Options for the helpers are
# stored in /etc/modprobe.conf.
IPTABLES_MODULES="nf_conntrack_ftp"