Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I configured Pure-FTPd-MySQL + IPTables but I have a problem with Passive mode (who doesn't?)

I forced this port range:

echo "1024 65535" > /etc/pure-ftpd/conf/PassivePortRange

In Iptables, a few rules handle FTP limitations. And I've got a problem with one of these:

iptables -A INPUT -p tcp -s 0/0 --sport 1024:65535 -d $SERVER_IP --dport 1024:65535 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

I want to disallow the NEW connections but if I do so, passive mode doesn't work anymore. Any idea why? I don't see any reason for this.

share|improve this question
1  
Do you have the ftp connection tracking module loaded? What is the result of lsmod|grep ftp? –  MadHatter Mar 4 '13 at 8:16

2 Answers 2

up vote 0 down vote accepted

ip_conntrack and ip_conntrack_ftp were missing. I added them to /etc/modules and voila.

share|improve this answer

Passive mode exists because otherwise you'd rely on being able to connect to the client on an arbitrary port for the data connection. In the days before firewalls this was fine, but in these days of network security and NATted segments, it's more than likely that such an attempt will fail.

Passive mode gets around the problem by letting the client connect to the server when data transfer starts. This means that the server can control what connections to permit and on what ports. In other words, you must allow connections to your passive ports from anywhere (assuming that your ftp server is open to the world).

My advice would be to narrow your port range considerably (I usually go for something like 40000-40100; obviously you'll need a wider range if you're expecting more than 100 simultaneous data transfers). For the reasons discussed above, you do still need that firewall rule to accept those incoming connections.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.