0

Sorry guys for the stupid question, but I can't open my FTP (ProFTPd) from browser on CentOS 6.5. When I stop IPtables I don't have problem, but when is running I have.

Port 21 is open, port 20 is not (I don't know how to open it).

EDIT 1:

The output from "iptables -L -n"

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22 
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:80 
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:21 
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:8000 
REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited 

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination 

EDIT 2: @HBruijn His way work for me.

  • Can you paste the output of iptables -L -n ? – thinice Jul 16 '14 at 19:14
1

Your question isn't phrased very well, but the symptoms you describe are indicative of a passive FTP not working correctly in combination with your firewall.

Typically the command insmod nf_conntrack_ftp is sufficient to load the FTP helper module in a badly configured RHEL6 or CentOS firewall.

To make that persistent:

Edit the configuration file /etc/sysconfig/iptables-config and add the helper module nf_conntrack_ftp to the IPTABLES_MODULES variable:

IPTABLES_MODULES="nf_conntrack_ftp"

or add it to any other modules already listed there.

| improve this answer | |
0

You can either directly edit the iptables config file /etc/sysconfig/iptables then restart the iptables service. Or modify then save the running config. As root, or sudo:

# If using a custom chain for this sort of thing, APPEND port to chain:
iptables -A MYCHAIN -m state --state NEW -p tcp --dport 20 -j ACCEPT
service iptables save

If you have a REJECT line in your INPUT chain, you'll want to make sure the port you're adding to the firewall is inserted before the REJECT:

# List the Chain with line numbers
iptables -L INPUT -n --line-numbers

# in this example 7 is REJECT line from the above,  this will push the REJECT line down
# and insert this right above it:
iptables -I INPUT 7 -m state --state NEW -p tcp --dport 20 -j ACCEPT
service iptables save

also dont forget to do the same for ip6tables if required.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.