With PureFTPd, Passive mode doesn't work if I don't accept new connections in iptables

Question

I configured Pure-FTPd-MySQL + IPTables but I have a problem with Passive mode (who doesn't?)

I forced this port range:

echo "1024 65535" > /etc/pure-ftpd/conf/PassivePortRange

In Iptables, a few rules handle FTP limitations. And I've got a problem with one of these:

iptables -A INPUT -p tcp -s 0/0 --sport 1024:65535 -d $SERVER_IP --dport 1024:65535 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

I want to disallow the NEW connections but if I do so, passive mode doesn't work anymore. Any idea why? I don't see any reason for this.

Answer 1

ip_conntrack and ip_conntrack_ftp were missing. I added them to /etc/modules and voila.

Answer 2

Passive mode exists because otherwise you'd rely on being able to connect to the client on an arbitrary port for the data connection. In the days before firewalls this was fine, but in these days of network security and NATted segments, it's more than likely that such an attempt will fail.

Passive mode gets around the problem by letting the client connect to the server when data transfer starts. This means that the server can control what connections to permit and on what ports. In other words, you must allow connections to your passive ports from anywhere (assuming that your ftp server is open to the world).

My advice would be to narrow your port range considerably (I usually go for something like 40000-40100; obviously you'll need a wider range if you're expecting more than 100 simultaneous data transfers). For the reasons discussed above, you do still need that firewall rule to accept those incoming connections.