3

after the upgrade from debian squeeze to wheezy I've got a problem with passive FTP connection. I could narrow it to be iptables related, as I could connect via FTP w/o problems after adding my IP to the iptables ACCEPT rule. Before the upgrade I was able just to do

modprobe nf_conntract_ftp ports=21332

and adding

iptables -A THRU -p tcp --dport 21332 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

now..it doesn't help anymore. The INPUT rule is being triggered as I can see in the counter, but the directory listing is the last thing it does. Setting up a passive-port range is the last thing I want to do, I dislike open ports.

I also tried the trick with helper mod by adding following rule before the actual rule for 21332

iptables -A THRU -p tcp -i eth0 --dport 21332 -m state --state NEW -m helper --helper ftp-21332 -j ACCEPT

but it doesn't help and is even not being triggered according to counter. The rule in the next line (w/o helper) is being triggered

edit1: Here is the logentry after a try to connect:

Jun 30 15:35:16 loki pure-ftpd: ([email protected]) [INFO] New connection from 84.187.121.71
Jun 30 15:35:16 loki pure-ftpd: ([email protected]) [INFO] crackyftp1 is now logged in
Jun 30 15:35:17 loki kernel: [168039.126400] drop_packet_IN=eth0 OUT= MAC=40:61:86:97:dd:15:00:26:88:75:ec:1d:08:00 SRC=84.187.121.71 DST=88.198.xx.19 LEN=52 TOS=0x00 PREC=0x00 TTL=121 ID=3663 DF PROTO=TCP SPT=42148 DPT=31437 WINDOW=8192 RES=0x00 SYN URGP=0

so it IS being dropped.. (passive FTP huh^^)

here some info:

# iptables --version
iptables v1.4.14

# lsmod |grep nf_
nf_nat_ftp             12460  0
nf_nat                 18242  1 nf_nat_ftp
nf_conntrack_ftp       12605  1 nf_nat_ftp
nf_conntrack_ipv4      14078  32 nf_nat
nf_defrag_ipv4         12483  1 nf_conntrack_ipv4
nf_conntrack           52720  7     xt_state,nf_conntrack_ipv4,xt_conntrack,nf_conntrack_ftp,nf_nat,nf_nat_ftp,xt_helper

# uname -a
Linux loki 3.2.0-4-amd64 #1 SMP Debian 3.2.46-1 x86_64 GNU/Linux

# iptables-save
# Generated by iptables-save v1.4.14 on Sun Jun 30 03:54:28 2013
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:BLACKLIST - [0:0]
:LOGDROP - [0:0]
:SPAM - [0:0]
:THRU - [0:0]
:WEB - [0:0]
:fail2ban-dovecot-pop3imap - [0:0]
:fail2ban-pureftpd - [0:0]
:fail2ban-ssh - [0:0]
-A INPUT -p tcp -m multiport --dports 110,995,143,993 -j fail2ban-dovecot-pop3imap
-A INPUT -p tcp -m multiport --dports 21,21332 -j fail2ban-pureftpd
-A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh
-A INPUT -p tcp -m multiport --dports 110,995,143,993 -j fail2ban-dovecot-pop3imap
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A INPUT -i eth0 -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
-A INPUT -i eth0 -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP
-A INPUT -i eth0 -p tcp -m tcp --tcp-flags FIN,RST FIN,RST -j DROP
-A INPUT -i eth0 -p tcp -m tcp --tcp-flags FIN,ACK FIN -j DROP
-A INPUT -i eth0 -p tcp -m tcp --tcp-flags ACK,URG URG -j DROP
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -j BLACKLIST
-A INPUT -j THRU
-A INPUT -j LOGDROP
-A OUTPUT -j ACCEPT
-A OUTPUT -s 93.223.38.223/32 -j ACCEPT
-A BLACKLIST -s 38.113.165.0/24 -j LOGDROP
-A BLACKLIST -s 202.177.216.0/24 -j LOGDROP
-A BLACKLIST -s 130.117.190.0/24 -j LOGDROP
-A BLACKLIST -s 117.79.92.0/24 -j LOGDROP
-A BLACKLIST -s 72.47.228.0/24 -j LOGDROP
-A BLACKLIST -s 195.200.70.0/24 -j LOGDROP
-A BLACKLIST -s 195.200.71.0/24 -j LOGDROP
-A LOGDROP -m limit --limit 5/sec -j LOG --log-prefix drop_packet_ --log-level 7
-A LOGDROP -p tcp -m tcp --dport 25 -m limit --limit 2/sec -j LOG --log-prefix spam_blacklist --log-level 7
-A LOGDROP -p tcp -m tcp --dport 80 -m limit --limit 2/sec -j LOG --log-prefix web_blacklist --log-level 7
-A LOGDROP -p tcp -m tcp --dport 22 -m limit --limit 2/sec -j LOG --log-prefix ssh_blacklist --log-level 7
-A LOGDROP -j REJECT --reject-with icmp-host-prohibited
-A THRU -p icmp -m limit --limit 1/sec -m icmp --icmp-type 8 -j ACCEPT
-A THRU -i eth0 -p tcp -m tcp --dport 25 -j ACCEPT
-A THRU -i eth0 -p udp -m udp --dport 53 -j ACCEPT
-A THRU -i eth0 -p tcp -m tcp --dport 80 -j ACCEPT
-A THRU -i eth0 -p tcp -m tcp --dport 110 -j ACCEPT
-A THRU -i eth0 -p tcp -m tcp --dport 143 -j ACCEPT
-A THRU -i eth0 -p tcp -m tcp --dport 465 -j ACCEPT
-A THRU -i eth0 -p tcp -m tcp --dport 585 -j ACCEPT
-A THRU -i eth0 -p tcp -m tcp --dport 993 -j ACCEPT
-A THRU -i eth0 -p tcp -m tcp --dport 995 -j ACCEPT
-A THRU -i eth0 -p tcp -m tcp --dport 2008 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A THRU -i eth0 -p tcp -m tcp --dport 10011 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A THRU -i eth0 -p tcp -m tcp --dport 21332 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A THRU -i eth0 -p tcp -m tcp --dport 30033 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT

-A fail2ban-dovecot-pop3imap -j RETURN
-A fail2ban-dovecot-pop3imap -j RETURN
-A fail2ban-pureftpd -j RETURN
-A fail2ban-pureftpd -j RETURN
-A fail2ban-ssh -j RETURN
-A fail2ban-ssh -j RETURN
COMMIT
# Completed on Sun Jun 30 03:54:28 2013

So, as I said, I have no problems with connecting when adding my IP to go through..but that's not a solution as noone except me can connect anymore~ If someone got an idea what the problem is, please help me! Thanks

Cracky

edit:

ok, I've ended up with using/adding a passive-port range by

-A THRU -i eth0 -p tcp -m tcp --dport 21333:21343 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT

and setting this range up in pure-ftpd configs.

echo "21333 21343" > /etc/pure-ftpd/conf/PassivePortRange

Sad that the nf_conntrack_ftp module or the iptables had a change or have a bug that the connection is not being tracked anymore like it was working before in squeeze.

2
  • Could you cut-and-paste into your answer an example of an ftp session that fails?
    – MadHatter
    Jun 30, 2013 at 8:40
  • added~ it shows clearly that my connection is being dropped.
    – Cracky
    Jun 30, 2013 at 13:42

2 Answers 2

1

ok, I've ended up with using/adding a passive-port range as a workaround by

-A THRU -i eth0 -p tcp -m tcp --dport 21333:21343 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT

and setting this range up in pure-ftpd configs.

echo "21333 21343" > /etc/pure-ftpd/conf/PassivePortRange

Sad that the nf_conntrack_ftp module or the iptables had a change or have a bug that the connection is not being tracked anymore like it was working before in squeeze.

0

Reading the above, I can't see what's so magic about port 21332. Everything you've written should work well provided the passive port chosen by the FTP server happens to be 21332. However, you show nothing that guarantees this. Is it possible that in the recent upgrade your old ftpd config file - with some entry guaranteeing this choice of port - got moved aside?

Note that, in the iptables log you've posted above, the dport is 31437. I remain unconvinced that the ftpd is picking the port 21332 that seems to be necessary.

4
  • The configfile is the same, also it's bound and is working when I "whitelist" my IP as stated before.. this is really weird.
    – Cracky
    Jun 30, 2013 at 13:58
  • You said it works for you if you whitelist your address, but you didn't show us that, so we don't know what you meant by "whitelist". If you meant that you added a rule allowing all inbound traffic from that address, and passive ftp then worked from it, that would be consistent with my theory above. It's better to show than tell, always!
    – MadHatter
    Jun 30, 2013 at 14:02
  • Oh, and what port are you running your ftp server on?
    – MadHatter
    Jun 30, 2013 at 14:05
  • The server is running on 21332. By "whitelist" I meant to allow all inbound traffic by -A INPUT -s 84.187.121.71 -j ACCEPT everything else was working before with the nf_conntrack_ftp module just fine w/o adding anything else.
    – Cracky
    Jun 30, 2013 at 14:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .