Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I would like to open the FTP port in my iptables.

The following is my config for iptables:

#!/bin/sh

IPT="/sbin/iptables"

# Flush old rules, old custom tables
$IPT --flush
$IPT --delete-chain

# Set default policies for all three default chains
$IPT -P INPUT DROP
$IPT -P FORWARD DROP
$IPT -P OUTPUT DROP

# Enable free use of loopback interfaces
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A OUTPUT -o lo -j ACCEPT

# All TCP sessions should begin with SYN
$IPT -A INPUT -p tcp ! --syn -m state --state NEW -s 0.0.0.0/0 -j DROP

# Accept inbound TCP packets
$IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A INPUT -p tcp --dport 22 -m state --state NEW -s 0.0.0.0/0 -j ACCEPT
$IPT -A INPUT -p tcp --dport 80 -m state --state NEW -s 0.0.0.0/0 -j ACCEPT
$IPT -A INPUT -p tcp --dport 3306 -m state --state NEW -s 0.0.0.0/0 -j ACCEPT

#cpanel ports
$IPT -A INPUT -p tcp --dport 20 -m state --state RELATED,ESTABLISHED -s 0.0.0.0/0 -j ACCEPT
$IPT -A INPUT -p udp --dport 20 -m state --state RELATED,ESTABLISHED -s 0.0.0.0/0 -j ACCEPT
$IPT -A INPUT -p tcp --dport 21 -m state --state NEW,ESTABLISHED,RELATED -s 0.0.0.0/0 -j ACCEPT
$IPT -A INPUT -p udp --dport 21 -m state --state NEW -s 0.0.0.0/0 -j ACCEPT
$IPT -A INPUT -p tcp --dport 53 -m state --state NEW -s 0.0.0.0/0 -j ACCEPT
$IPT -A INPUT -p udp --dport 53 -m state --state NEW -s 0.0.0.0/0 -j ACCEPT
$IPT -A INPUT -p tcp --dport 443 -m state --state NEW -s 0.0.0.0/0 -j ACCEPT
$IPT -A INPUT -p tcp --dport 2083 -m state --state NEW -s 0.0.0.0/0 -j ACCEPT
$IPT -A INPUT -p tcp --dport 2087 -m state --state NEW -s 0.0.0.0/0 -j ACCEPT

# Accept outbound packets
$IPT -I OUTPUT 1 -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPT -A OUTPUT -p udp --dport 53 -m state --state NEW -j ACCEPT
$IPT -A OUTPUT -p udp --dport 21 -m state --state NEW -j ACCEPT
$IPT -A OUTPUT -p tcp --dport 21 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A OUTPUT -p tcp --dport 20 -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPT -A OUTPUT -p udp --dport 20 -m state --state RELATED,ESTABLISHED -j ACCEPT

#open all output
$IPT -P OUTPUT ACCEPT
# Save settings
#
/sbin/service iptables save
#
# List rules
#
iptables -L -v

But still when iptables is UP I can just establish the connection to the FTP server, but cannot list the structure.

All help is appreciated.

share|improve this question
    
Do you want internet access on this machine, like browsing google? This looks like needs some reshuffling. –  Andrew Smith Jul 26 '12 at 13:18
add comment

1 Answer

Your FTP client is probably in active mode, which means that the server tries to make a connection to the client when transferring data (files and file listings). You want to set your client to use passive mode, where the client connects to the server for data transfer. The --state RELATED rule in the INPUT chain should accept these data connections.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.