With the following rules inside the nftables input chaing:

tcp dport 21 ct state established,new counter accept
tcp dport 20 ct state established,related counter accept
tcp dport 1024-65535 ct state established,related counter accept

The pasive FTP connections can login but the data connection can't be established.


In recent kernels (>4.7) it's necessary to load the following module:

modprobe nf_conntrack_ftp

And enable the helper:

echo 1 > /proc/sys/net/netfilter/nf_conntrack_helper


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.