I installed proftp on my machine.
With iptables disabled I can connect to the machine, using ftp-client or telnet.
With iptables connection fails - telnet says "Connection failed"
# works
telnet 192.10.10.11 22
# connection failed
telnet 192.19.10.11 20
telnet 192.19.10.11 21
I found this topic, but it did not help.
Since I do open the Ports 22 and 21,20 the same way they should all be accessable through telnet? But 22 works and 21,20 fail. Any ideas why this happens?
sudo iptables -L -v
Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- lo any anywhere anywhere
100 7136 ACCEPT tcp -- any any anywhere anywhere tcp dpt:ssh
3 152 ACCEPT tcp -- any any anywhere anywhere tcp dpt:ftp
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpts:1010:1012
586 78898 ACCEPT udp -- eth0 any anywhere anywhere udp dpt:openvpn
0 0 ACCEPT all -- tun+ any anywhere anywhere
348 22567 ACCEPT all -- tap+ any anywhere anywhere
69 10294 DROP all -- any any anywhere anywhere
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- any lo anywhere anywhere
95 11028 ACCEPT tcp -- any any anywhere anywhere tcp spt:ssh
0 0 ACCEPT tcp -- any any anywhere anywhere tcp spt:ftp-data
354 55626 ACCEPT udp -- any eth0 anywhere anywhere udp dpt:openvpn
0 0 ACCEPT all -- any tun+ anywhere anywhere
353 26295 ACCEPT all -- any tap+ anywhere anywhere
4 392 DROP all -- any any anywhere anywhere
iptables configurations:
#!/bin/sh
# Flushing all rules
iptables -F
iptables -X
# Setting default filter policy
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
# Allow unlimited traffic on loopback
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
# Allow ssh on Port 22
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
# Ports for FTP
#Allowing FTP Connections, including passive ports. (proftpd)
sudo iptables -A INPUT -p tcp --dport 21 -j ACCEPT
# Allowing FTP Connections in active mode, where Data are passed through Port 20
sudo iptables -A OUTPUT -p tcp --sport 20 -j ACCEPT
# Allowing Ports for Passive Mode connection, where Data is passed through ports
sudo iptables -A INPUT -p tcp --dport 1010:1012 -j ACCEPT
# allow connection via 1194 so that openVpn can use the network adapter
iptables -A INPUT -i eth0 -p udp --dport 1194 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --dport 1194 -j ACCEPT
# allow connections via openVPN tun and tap interfaces
iptables -A INPUT -i tun+ -j ACCEPT
iptables -A OUTPUT -o tun+ -j ACCEPT
iptables -A INPUT -i tap+ -j ACCEPT
iptables -A OUTPUT -o tap+ -j ACCEPT
# make sure nothing else comes or goes out of this box
iptables -A INPUT -j DROP
iptables -A OUTPUT -j DROP