1

With the following rules inside the nftables input chaing:

tcp dport 21 ct state established,new counter accept
tcp dport 20 ct state established,related counter accept
tcp dport 1024-65535 ct state established,related counter accept

The pasive FTP connections can login but the data connection can't be established.

1 Answer 1

1

In recent kernels (>4.7) it's necessary to load the following module:

modprobe nf_conntrack_ftp

And enable the helper:

echo 1 > /proc/sys/net/netfilter/nf_conntrack_helper

1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .