Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My FTP(s) isn't working when my firewall is enabled. I have always had my iptables set up for me in the past, I learnt roughly how to set one up yesterday, but I've missed a rule that this requires. Here is my iptables.rules

# Generated by iptables-save v1.4.4 on Tue Nov 16 23:23:50 2010
*filter
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]

-A INPUT -i lo -j ACCEPT
-A INPUT -m state -i eth0 --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 20:21 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 989:990 -j ACCEPT
-A INPUT -p tcp -m tcp -i eth0 --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp -i eth0 --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp -i eth0 --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp -i eth0 --dport 10000 -j ACCEPT
-A INPUT -p icmp -i eth0 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-port-unreachable


COMMIT
# Completed on Tue Nov 16 23:23:50 2010
# Generated by iptables-save v1.4.4 on Tue Nov 16 23:23:50 2010
*mangle
:PREROUTING ACCEPT [95811:65665815]
:INPUT ACCEPT [92355:65212126]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [55795:22371752]
:POSTROUTING ACCEPT [55795:22371752]
COMMIT
# Completed on Tue Nov 16 23:23:50 2010
# Generated by iptables-save v1.4.4 on Tue Nov 16 23:23:50 2010
*nat
:PREROUTING ACCEPT [5132:543438]
:POSTROUTING ACCEPT [953:67517]
:OUTPUT ACCEPT [953:67517]
COMMIT
# Completed on Tue Nov 16 23:23:50 2010

So just to summarize, my FTP will connect but not show any files with the firewall enabled. with firewall disabled, everything is perfect.

EDIT: the only otherway I have got this to work with the firewall is disabling ipv6, disabling TLS and adding a rule to the firewall which allows connection from my home network (server is elsewhere)

share|improve this question
1  
You might want to put the rules in a qoute or code block. –  Joshua Enfield Nov 17 '10 at 22:06
    
Are you able to connect with new ssh sessions after enabling the firewall? Am I correct in assuming your using SFTP (runs on the ssh port)? You could try SFTPing from the linux box to the same linux box using the nonlocal IP. You can pass in -vvv to the sftp command for some very detailed debugging information. –  Joshua Enfield Nov 17 '10 at 22:10
    
Also it may be helpful to run nmap -h [nonlocal-ip of machine] IIRC against the machine and see what ports it actually sees open. –  Joshua Enfield Nov 17 '10 at 22:17
    
I see now you are probably actually using FTPS with tls (sorry I missed it). You might need port 990 and 989 open depending on your setup - en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers –  Joshua Enfield Nov 17 '10 at 22:20
    
i had opened those ports: -A INPUT -p tcp -m tcp --dport 989:990 -j ACCEPT –  Juddling Nov 17 '10 at 22:25
show 1 more comment

3 Answers

up vote 4 down vote accepted

In Passive mode, when the client wants to get a file from the server or send a file to the server, the FTP server will pick a random port and send that port to the FTP client.

When you're not using encryption, a properly configured firewall (using the ip_conntrack_ftp helper kernel module, which may be what you're missing for non-TLS connections) would "listen in" on the connection and mark these connections as RELATED. With encryption the firewall can't listen in.

The quick and dirty solution to this is to configure the FTP server to choose a small range of ports for passive connections, and then allow access to all of these ports. For instance, in vsftpd:

pasv_min_port=12000
pasv_max_port=12049

Then in iptables:

iptables -A INPUT -p tcp -m tcp -i eth0 --dport 12000:12049 -j ACCEPT

Allowing anyone to access these ports opens one possible exploit: if someone were to be scanning them over and over they might get lucky and be able to "beat" the real user to the data port and grab the file. Ideally your FTP server would check and make sure the connection is coming from the same place as the original connection, but thanks to things like "FXP" (transferring files from one server to another server by convincing one to make an active connection to the other's passive data port) some servers don't check the connection by default. You should check your configuration file and see if there is an option to disable FXP, and use it. (vsftpd calls this "promiscuous" and is disabled by default.)

share|improve this answer
    
+1 for the FTPS-friendly firewall howto. –  Steven Monday Nov 18 '10 at 0:51
    
Thanks very much, I edited my proftpd.conf, and added the rule to my iptables and it now works perfectly. –  Juddling Nov 19 '10 at 12:56
add comment

if the FTP connection starts but no files can be seen/transferred then try using passive mode (just type PASV in a commandline ftp client). Without passive mode the server will try to set up a connection back to your machine on an anonymous port. At least, that's what happens with plain FTP - don't know how it is done with FTPS :S

HTH,

JJK

share|improve this answer
    
I was using passive mode. FireFTP will only let me use passive mode. –  Juddling Nov 17 '10 at 22:33
add comment

I don't have direct experience with FTPS, but it is possible that because the control channel is encrypted, netfilter's connection-tracking code is not able to learn the appropriate port to open to allow a client's incoming data connection (for passive mode). That might explain why "everything is perfect" when the firewall is disabled. If possible, try using active mode. Unfortunately, I suspect that if the client is also behind a firewall, then active mode is likely to be blocked as well, for much the same reason!

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.