Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using these iptables rules for my OpenVPN server with 1 NIC (eth0)

iptables -I INPUT -i eth0 -p udp --dport 1194 -j ACCEPT
iptables -I FORWARD -i eth0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o eth0 -j ACCEPT
iptables -t nat -I POSTROUTING -o eth0 -j MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward

which of course is much too open.

But I would like to be able to use FTP through the VPN connection.

I assume I have to put

modprobe ip_conntrack
modprobe ip_conntrack_ftp

in top of my iptables script.

But how should the actual iptables rules look like?

share|improve this question
Active or passive mode ftp? It looks to me right now as if passive mode, at least, should work. Can you show us what happens when you try it? – MadHatter Sep 2 '11 at 11:42
@MadHatter : Yes, passive should work, but the problem seams to be active, according to this wikipedia article. – Sandra Sep 2 '11 at 12:04
As I said, passive mode at least should work, and imho active as well, with the ruleset you've posted and those two modules applied. What happened when you tried it? – MadHatter Sep 2 '11 at 15:33
You are right! I thought the problem was in the VPN, but apparently the FTP server was down =) If you copy/paste you last comment as answer, I will accept =) – Sandra Sep 2 '11 at 19:01
OK, thanks. I've added what might be a useful pointer or two about making the rules a little tighter. – MadHatter Sep 2 '11 at 19:19
up vote 1 down vote accepted

With the rules you give above, both active and passive mode FTP should work right now.

If you want to be a bit more precise about accepting only ftp control and data connections, and assuming the client is on the OpenVPN interface, you could replace the two general accepts with

iptables -A FORWARD -i tun0 -o eth0 -p tcp --dport 21 -j ACCEPT
iptables -A FORWARD -i eth0 -o tun0 -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i tun0 -o eth0 -p tcp -m state --state ESTABLISHED -j ACCEPT
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.