ProFTPD and firewall configuration for PassivePorts

Question

I use ProFTPD on my server, and when I try to connect to my server with FileZilla or WinSCP, I have this error :

Command: MLSD
Error:   Connection timed out
Error:   Failed to retrieve directory listing

My firewall configuration is (/etc/init.d/firewall) :

#!/bin/sh

sudo iptables -t filter -F
sudo iptables -t filter -X

sudo iptables -t filter -P INPUT DROP
sudo iptables -t filter -P FORWARD DROP
sudo iptables -t filter -P OUTPUT DROP

sudo iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
sudo iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
sudo iptables -t filter -A INPUT -i lo -j ACCEPT
sudo iptables -t filter -A OUTPUT -o lo -j ACCEPT

# ICMP (Ping)
sudo iptables -t filter -A INPUT -p icmp -j ACCEPT
sudo iptables -t filter -A OUTPUT -p icmp -j ACCEPT

# SSH
sudo iptables -t filter -A INPUT -p tcp --dport 3636 -j ACCEPT
sudo iptables -t filter -A OUTPUT -p tcp --dport 3636 -j ACCEPT
sudo iptables -t filter -A INPUT -p tcp --dport 22 -j ACCEPT
sudo iptables -t filter -A OUTPUT -p tcp --dport 22 -j ACCEPT

# DNS
sudo iptables -t filter -A OUTPUT -p tcp --dport 53 -j ACCEPT
sudo iptables -t filter -A OUTPUT -p udp --dport 53 -j ACCEPT
sudo iptables -t filter -A INPUT -p tcp --dport 53 -j ACCEPT
sudo iptables -t filter -A INPUT -p udp --dport 53 -j ACCEPT

# HTTP
sudo iptables -t filter -A OUTPUT -p tcp --dport 80 -j ACCEPT
sudo iptables -t filter -A INPUT -p tcp --dport 80 -j ACCEPT

# FTP
sudo iptables -t filter -A OUTPUT -p tcp --dport 20:21 -j ACCEPT
sudo iptables -t filter -A INPUT -p tcp --dport 20:21 -j ACCEPT

# Mail SMTP
sudo iptables -t filter -A INPUT -p tcp --dport 25 -j ACCEPT
sudo iptables -t filter -A OUTPUT -p tcp --dport 25 -j ACCEPT

# Mail POP3
sudo iptables -t filter -A INPUT -p tcp --dport 110 -j ACCEPT
sudo iptables -t filter -A OUTPUT -p tcp --dport 110 -j ACCEPT

# Mail IMAP
sudo iptables -t filter -A INPUT -p tcp --dport 143 -j ACCEPT
sudo iptables -t filter -A OUTPUT -p tcp --dport 143 -j ACCEPT

# NTP
sudo iptables -t filter -A OUTPUT -p udp --dport 123 -j ACCEPT

iptables -A FORWARD -p udp -m limit --limit 1/second -j ACCEPT
iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/second -j ACCEPT

iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT

Have you a solution please ? Thanks.

Answer 1

Yout packet filter configuration is a mess. Basically, you should set the OUTPUT chain to pass everything (unless you want to filter outgoing traffic initiated from your host) setting it's policy to PASS, and then filter incoming connections using only the INPUT chain (keepeing in mind that you already added the established rule, allowing what you need. This way your host will be able to communicate with the outer world whatever it decides, and outer world will be able to communicate with the ports you allow in the INPUT. The only exception will be the UDP rules, which you will need to allow the incoming part for.

As about passive/active FTP mode, in order to allow DATA traffic to pass, you should allow in the INPUT chains the PassivePort range from the proftpd.conf (this way the passive ftp will work) and active ftp will work just fine using the OUTPUT pass policy.

Answer 2

You are using "-m state --state RELATED,ESTABLISHED" but you are not using "-m state --state NEW" in your iptables rules

example for allowing ssh:

 iptables -t filter -A INPUT -p tcp --dport 22 --syn -m state --state NEW -j ACCEPT

Answer 3

For Active and Passive transfer you need to open the following ports:

IN: TCP 20,21,60000-65535

OUT: TCP 20,21,60000-65535

Then update FTP to use passive port range 60000-65535.

Then on clinet side use Passive mode (in case NATed IP) other wise Active will work as well.

Details and instructions