Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Linux server and the default INPUT actions is DROP. OUTPUT and FORWARD are both ACCEPT.

Which rule do I have to add to enabled the machine to establish an FTP session as FTP client. The server is not an FTP-server. Here is my firewall rules. Why I could not ping any remote machine or anything about OUTPUT.

# Generated by iptables-save v1.4.12 on Wed Oct 10 15:30:17 2012
*nat
:PREROUTING ACCEPT [379:59440]
:INPUT ACCEPT [162:34762]
:OUTPUT ACCEPT [5008:361967]
:POSTROUTING ACCEPT [5008:361967]
COMMIT
# Completed on Wed Oct 10 15:30:17 2012
# Generated by iptables-save v1.4.12 on Wed Oct 10 15:30:17 2012
*filter
:INPUT DROP [8:528]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [201:14768]
:LOGGING - [0:0]
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p esp -j ACCEPT
-A INPUT -i ppp+ -j ACCEPT
-A INPUT -p udp -m udp --dport 500 -j ACCEPT
-A INPUT -p udp -m udp --dport 4500 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i lo -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p udp -m udp --dport 1701 -j ACCEPT
-A FORWARD -i ppp+ -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT

COMMIT

UPDATED:

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p esp -j ACCEPT
-A INPUT -i ppp+ -j ACCEPT
-A INPUT -p udp -m udp --dport 500 -j ACCEPT
-A INPUT -p udp -m udp --dport 4500 -j ACCEPT
-A INPUT -p udp -m udp --dport 1701 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i lo -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
-A FORWARD -i ppp+ -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
share|improve this question

migrated from stackoverflow.com Oct 10 '12 at 11:23

This question came from our site for professional and enthusiast programmers.

add comment

2 Answers

up vote 1 down vote accepted

As a client, to allow FTP in passive mode, it's enough to allow back-half connections:

iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT

though since rules processing is order-sensitive, it's up to you to put that rule in the right place in your INPUT chain. Near the top is probably a good place.

Edit: OUTPUT traffic is allowed, according to the rules you've posted. If you think it's not, it would be helpful to see the running ruleset not the startup ruleset; try iptables -L -n -v, and post the output of that.

As for PINGs, you're not allowing the backhalves of those in, either. The rule I gave above should start those working, too.

share|improve this answer
    
The general problem is output traffic is not alloed though default OUTPUT action is ACCEPT. I have added my firewall rules. I could not even ping any machine when rules are applied. –  mmc18 Oct 10 '12 at 11:45
    
ouput traffic IS allowed. You problem is that you are not accepting the responses. ping, like nearly all internet traffic, is two-way. You are allowing the request to go out, but not the response to come back. Try iptables -I INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT (note that this is not interface specific, whereas you have a rule doing this currently only for the loopback interface...) –  Norky Oct 10 '12 at 12:09
    
Thanks, Norky, I think that's exactly what I'd already said in my edit above. Nice to get confirmation! –  MadHatter Oct 10 '12 at 12:10
    
Yup, I am echoing pretty much what MadHatter already said, with the small addition of "RELATED" to the rule. –  Norky Oct 10 '12 at 12:11
    
I think state module is obsoleted by conntrack –  AnonymousLurker Oct 10 '12 at 12:25
show 5 more comments

You might also need to make sure the connection tracking module for FTP is loaded, if it is not already (exactly what it is called will depend on your kernel version/distribution).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.