2

My FTP(s) isn't working when my firewall is enabled. I have always had my iptables set up for me in the past, I learnt roughly how to set one up yesterday, but I've missed a rule that this requires. Here is my iptables.rules

# Generated by iptables-save v1.4.4 on Tue Nov 16 23:23:50 2010
*filter
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]

-A INPUT -i lo -j ACCEPT
-A INPUT -m state -i eth0 --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 20:21 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 989:990 -j ACCEPT
-A INPUT -p tcp -m tcp -i eth0 --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp -i eth0 --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp -i eth0 --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp -i eth0 --dport 10000 -j ACCEPT
-A INPUT -p icmp -i eth0 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-port-unreachable


COMMIT
# Completed on Tue Nov 16 23:23:50 2010
# Generated by iptables-save v1.4.4 on Tue Nov 16 23:23:50 2010
*mangle
:PREROUTING ACCEPT [95811:65665815]
:INPUT ACCEPT [92355:65212126]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [55795:22371752]
:POSTROUTING ACCEPT [55795:22371752]
COMMIT
# Completed on Tue Nov 16 23:23:50 2010
# Generated by iptables-save v1.4.4 on Tue Nov 16 23:23:50 2010
*nat
:PREROUTING ACCEPT [5132:543438]
:POSTROUTING ACCEPT [953:67517]
:OUTPUT ACCEPT [953:67517]
COMMIT
# Completed on Tue Nov 16 23:23:50 2010

So just to summarize, my FTP will connect but not show any files with the firewall enabled. with firewall disabled, everything is perfect.

EDIT: the only otherway I have got this to work with the firewall is disabling ipv6, disabling TLS and adding a rule to the firewall which allows connection from my home network (server is elsewhere)

7
  • 1
    You might want to put the rules in a qoute or code block. Nov 17, 2010 at 22:06
  • Are you able to connect with new ssh sessions after enabling the firewall? Am I correct in assuming your using SFTP (runs on the ssh port)? You could try SFTPing from the linux box to the same linux box using the nonlocal IP. You can pass in -vvv to the sftp command for some very detailed debugging information. Nov 17, 2010 at 22:10
  • Also it may be helpful to run nmap -h [nonlocal-ip of machine] IIRC against the machine and see what ports it actually sees open. Nov 17, 2010 at 22:17
  • I see now you are probably actually using FTPS with tls (sorry I missed it). You might need port 990 and 989 open depending on your setup - en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers Nov 17, 2010 at 22:20
  • i had opened those ports: -A INPUT -p tcp -m tcp --dport 989:990 -j ACCEPT
    – Juddling
    Nov 17, 2010 at 22:25

3 Answers 3

7

In Passive mode, when the client wants to get a file from the server or send a file to the server, the FTP server will pick a random port and send that port to the FTP client.

When you're not using encryption, a properly configured firewall (using the ip_conntrack_ftp helper kernel module, which may be what you're missing for non-TLS connections) would "listen in" on the connection and mark these connections as RELATED. With encryption the firewall can't listen in.

The quick and dirty solution to this is to configure the FTP server to choose a small range of ports for passive connections, and then allow access to all of these ports. For instance, in vsftpd:

pasv_min_port=12000
pasv_max_port=12049

Then in iptables:

iptables -A INPUT -p tcp -m tcp -i eth0 --dport 12000:12049 -j ACCEPT

Allowing anyone to access these ports opens one possible exploit: if someone were to be scanning them over and over they might get lucky and be able to "beat" the real user to the data port and grab the file. Ideally your FTP server would check and make sure the connection is coming from the same place as the original connection, but thanks to things like "FXP" (transferring files from one server to another server by convincing one to make an active connection to the other's passive data port) some servers don't check the connection by default. You should check your configuration file and see if there is an option to disable FXP, and use it. (vsftpd calls this "promiscuous" and is disabled by default.)

2
  • +1 for the FTPS-friendly firewall howto. Nov 18, 2010 at 0:51
  • Thanks very much, I edited my proftpd.conf, and added the rule to my iptables and it now works perfectly.
    – Juddling
    Nov 19, 2010 at 12:56
1

I don't have direct experience with FTPS, but it is possible that because the control channel is encrypted, netfilter's connection-tracking code is not able to learn the appropriate port to open to allow a client's incoming data connection (for passive mode). That might explain why "everything is perfect" when the firewall is disabled. If possible, try using active mode. Unfortunately, I suspect that if the client is also behind a firewall, then active mode is likely to be blocked as well, for much the same reason!

0

if the FTP connection starts but no files can be seen/transferred then try using passive mode (just type PASV in a commandline ftp client). Without passive mode the server will try to set up a connection back to your machine on an anonymous port. At least, that's what happens with plain FTP - don't know how it is done with FTPS :S

HTH,

JJK

1
  • I was using passive mode. FireFTP will only let me use passive mode.
    – Juddling
    Nov 17, 2010 at 22:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .