Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I cannot deny access to FTP for a IP address.

First of all i needed to deny everything so i did like this:

#iptables -F
#iptables -P INPUT DROP
#iptables -P OUTPUT DROP
#iptables -P FORWARD DROP

Then I opened FTP:

#modprobe ip_conntrack_ftp
#iptables -A INPUT -p TCP -i eth0 --dport 21 -m state --state NEW -j ACCEPT
#iptables -A INPUT -p ALL -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
#iptables -A OUTPUT -p ALL -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

The above works but I have all so tried with this one to:

#modprobe ip_conntrack
#modprobe ip_conntrack_ftp
#iptables -A INPUT -p tcp -s 0/0 --sport 1024:65535 -d --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
#iptables -A OUTPUT -p tcp -s --sport 21 -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
#iptables -A INPUT -p tcp -s 0/0 --sport 1024:65535 -d --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT
#iptables -A OUTPUT -p tcp -s --sport 1024:65535 -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
#iptables -A OUTPUT -p tcp -s --sport 20 -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT
#iptables -A INPUT -p tcp -s 0/0 --sport 1024:65535 -d --dport 20 -m state --state ESTABLISHED -j ACCEPT

Now I need to deny one IP so that one computer cannot access FTP, lets say

#iptables -A INPUT -s -d -p tcp -m tcp --dport 21 -j DROP

I have also tried this

#iptables -A INPUT -p tcp -s --dport 21 -j DROP

And it says in iptables -L that it is dropped but when I use fillezilla it goes through. I have droped ports 20,21,22.

So why is the connection being permitted when the rules should be dropping it?

share|improve this question

The important thing to realize here is that firewall within a single table are processed in order. As soon as a match is found, processing stops for that chain and the action is taken.

So what you probably need to do is put your drop for ftp from that IP address before the general rule that permits FTP. The -A appends a rule to a chain. What you probably want is -I to insert the rule to a chain. By default the rule is inserted at the top of the chain when you use -I, but you can also pass a number that will place it ahead of the number of the rule you specified.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.