Help Needed Adding FTP To IPTables in Ubuntu 10.10

Question

I have an existing IPtables script running on a LAMP stacked VPS and I need help allowing FTP connections so I can upload and download files to my web server.

I have already installed vsftpd to ubuntu and configured it for authenicated user access but I think my firewall is refusing the connection request.

I have tried modprobe ip_conntrack_ftp to load the module. But I still cant't connect via FTP

*filter
#  Allows all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT -i ! lo -d 127.0.0.0/8 -j REJECT

#  Accepts all established inbound connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#  Allows all outbound traffic
#  You could modify this to only allow certain traffic
#  This is in addition to allowing established and related traffic as listed above
-A OUTPUT -j ACCEPT

# Allows HTTP and HTTPS connections from anywhere (the normal ports for websites)
-A INPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT

#Allows FTP traffic
-A INPUT -p tcp -m tcp --dport 20 -j LOG
-A INPUT -p tcp -m tcp --dport 21 -j LOG
-A OUTPUT -p tcp -m tcp --sport 20 -j LOG
-A OUTPUT -p tcp -m tcp --sport 21 -j LOG

#  Allows SSH connections from trusted-host only - drop the rest
-A INPUT -p tcp -m state --state NEW --source 84.70.321.123 --dport 30000 -j ACCEPT
-A INPUT -p tcp --dport 30000 -j DROP

# Create time lock for non-wanted SSH attempts of a period of 1 minute
-A INPUT -p tcp -m state --syn --state NEW --dport 30000 -m limit --limit 1/minute     -limit-burst 1 -j ACCEPT
-A INPUT -p tcp -m state --syn --state NEW --dport 30000 -j DROP

# Allow ping
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
COMMIT

I keep getting connection and I am not sure why.

Please explain this in the most simplest of terms because it seems a little bit complicated and I see many people have similar questions that would benefit from a simple explanation.

Answer 1

FTP can be a problematic protocol. I've taken to just not using it at all (replacing it the the more secure and efficient SCP or SFTP as provided by most SSH packages, or (better still) rsync over ssh where available).

But things to look for or try:

• Check to make sure it works if your firewall is temporarily set to accept anything. This will confirm that your firewall setup is the problem and there isn't an issue elsewhere instead.
• Make sure the client is using PASV mode, otherwise the server will be trying to connect back to the client and a block at that end could be the problem not your firewall.
• Check what port the client is trying to use for the data connection (a good FTP client will have an option to see a full log of what gets sent on the command connection, look for a PORT command just before it tries the transfer). See http://slacksite.com/other/ftp.html for an explanation of how to interpret PASV commands (and the difference between active and passive modes).
• You don't say whether the FTP client connects at all, or if it fails at the point of getting a directory listing or getting/sending a file. If the latter then the active/passive mode thing is moot (that only comes into play once the command connection is open. Again look at the logs, or try a command line client. If the FTP client gets as far as making a connection (and accepting your username/password) then you are getting a command connection OK.

Though my general recommendation, assuming you can square it with your users is to use SFPT/SCP via SSH instead of FTP. I square it with my users by explaining the better security and efficiency, and if that fails I go with "if you really want to use FTP then please consider using a different service". Just about all Linux setups have both command line support and GUI support (enter sftp://server.domain.tld/ or similar into the default file manager on Ubuntu for instance) out of the box and there are several good clients for Windows (I use WinSCP for GUI use and Cygwin's OpenSSH package for command line use, though WinSCP supports command line use too).

Answer 2

By default, vsftp.conf should have the following line:

connect_from_port_20=yes

That sets vsFTP to active mode and thus will connect back to the client via port 20. If that is NOT enabled, that means that means that vsFTP is set to passive mode, which will require that you open up a range of ports in the firewall above 1024.