1

Possible Duplicate:
Allowing FTP with IPTables

I have a pretty restrictive set of iptables rules with the following rule that allows me to connect by ftp

iptables -A INPUT -p tcp --dport 21 -j ACCEPT

Clients can connect ok but that's about it, the following output from the ftp client just before things fall down might help:

Command:    MLSD
Error:  Connection timed out
Error:  Failed to retrieve directory listing

When I stop IP tables everything works as expected


CentOS release 5.5 (Final)

proftpd-1.3.3c-3

0

4 Answers 4

6

You'll need an additional rule to allow "related" connections. This is due to the FTP protocol using one port for commands and another for data.

iptables -A INPUT -p tcp --dport 21 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

Also, there's a kernel module you'll need to load for tracking the related connections. It's called ip_conntrack_ftp but how you load it depends on your distro.

On hedrat-ish systems, have an ogle at /etc/sysconfig/iptables-config

3
  • +1, i suspect this'll work, totally forgot about the related connections need.
    – Sirex
    Jan 20, 2011 at 11:06
  • This did the tick, kudos to all for contributing to this solution!
    – stew
    Jan 20, 2011 at 11:12
  • To enable the module on CentOS you can use the command: # modprobe ip_conntrack_ftp Jun 18, 2014 at 14:49
2

Just to break down the difference:

Active FTP: The client connects to port 21 on the server. This is the control channel. Getting files or directory listings are data transfers and the server then attempts to connect back to the client to send it. This almost never works these days, given the way most clients are NATted and firewalled.

Passive FTP: There still needs to be a data channel, but this time, the server sends a port number back to the client and the client initiates another connection back to the server on that port.

The reason you're timing out with the data connection in passive is that the data port is still blocked. Depending on your FTP server software, you can typically specify the range of ports the server sends (eg: 50000-50010). You then also need to accept inbound connections on that port range. (Make sure you also limit the number of simultaneous connections to the same as the number of ports available.)

I'm not familiar with proftpd, but I think it lets you do what you need to do.

Edit Noodl's answer is the best bet for allowing the data connections through, though you may want to be specific about the port range anyway, for ease of tracking.

0

Try setting your client to use passive FTP, assuming you're using a NAT, that should work.

In filezilla its in the connection settings, on the command line i think "passive" should turn it on, do that before the ls/dir command.

2
  • Cheers, tried that and alas it didn't work - same error
    – stew
    Jan 20, 2011 at 10:48
  • does the user have permissions to do the listing ? Perhaps try it from localhost to rule out network issues.
    – Sirex
    Jan 20, 2011 at 10:57
0

You can use the netfilter conntrack module:

modprobe nf_conntrack_ftp 

And to be loaded at startup, in /etc/sysconfig/iptables-config :

IPTABLES_MODULES="nf_conntrack_ftp"
1
  • Thanks this in conjunction with the above answer got me rolling again! (sorry my newbie rep won't allow me to vote this one up :( )
    – stew
    Jan 20, 2011 at 11:13

Not the answer you're looking for? Browse other questions tagged .