up vote 1 down vote favorite
share [g+] share [fb]

I'm using these iptables rules for my OpenVPN server with 1 NIC (eth0)

iptables -I INPUT -i eth0 -p udp --dport 1194 -j ACCEPT
iptables -I FORWARD -i eth0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o eth0 -j ACCEPT
iptables -t nat -I POSTROUTING -o eth0 -j MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward

which of course is much too open.

But I would like to be able to use FTP through the VPN connection.

I assume I have to put

modprobe ip_conntrack
modprobe ip_conntrack_ftp

in top of my iptables script.

But how should the actual iptables rules look like?

link|improve this question
100% accept rate
Active or passive mode ftp? It looks to me right now as if passive mode, at least, should work. Can you show us what happens when you try it? – MadHatter Sep 2 '11 at 11:42
@MadHatter : Yes, passive should work, but the problem seams to be active, according to this wikipedia article. en.wikipedia.org/wiki/Ftp#NAT_and_firewall_traversal – Sandra Sep 2 '11 at 12:04
As I said, passive mode at least should work, and imho active as well, with the ruleset you've posted and those two modules applied. What happened when you tried it? – MadHatter Sep 2 '11 at 15:33
You are right! I thought the problem was in the VPN, but apparently the FTP server was down =) If you copy/paste you last comment as answer, I will accept =) – Sandra Sep 2 '11 at 19:01
1  
OK, thanks. I've added what might be a useful pointer or two about making the rules a little tighter. – MadHatter Sep 2 '11 at 19:19
feedback

1 Answer

up vote 1 down vote accepted

With the rules you give above, both active and passive mode FTP should work right now.

If you want to be a bit more precise about accepting only ftp control and data connections, and assuming the client is on the OpenVPN interface, you could replace the two general accepts with

iptables -A FORWARD -i tun0 -o eth0 -p tcp --dport 21 -j ACCEPT
iptables -A FORWARD -i eth0 -o tun0 -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i tun0 -o eth0 -p tcp -m state --state ESTABLISHED -j ACCEPT
link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.