Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm a complete noob and am just having the worst time trying to get FTP access to the server. I want to keep the firewall enabled.

Edit: Updated the iptables information.

I have the following rules enabled:

Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
58398 7869K RH-Firewall-1-INPUT  all  --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:22
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:21
    0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:!0x17/0x02 state NEW
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:21 state NEW

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 RH-Firewall-1-INPUT  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy DROP 5841 packets, 350K bytes)
 pkts bytes target     prot opt in     out     source               destination
 4046  299K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
    2   114 ACCEPT     all  --  *      lo      0.0.0.0/0            0.0.0.0/0
 2935  196K ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:53 state NEW
  170 10200 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:21 ctstate NEW,ESTABLISHED
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:20 ctstate NEW,ESTABLISHED

Chain RH-Firewall-1-INPUT (2 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:80
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:3306
   26 10260 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           icmp type 255
    0     0 ACCEPT     esp  --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     ah   --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            224.0.0.251         udp dpt:5353
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:631
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:631
 8465  774K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22
49907 7084K REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpts:30000:35000
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:21
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:20
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:21
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:22
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:21
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:20
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:21 ctstate NEW,ESTABLISHED
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:20 ctstate NEW,ESTABLISHED
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state ESTABLISHED

I know it's waaaay more than necessary, but I'm at my wits end. I can connect to the server just fine when I disable iptables, so I know it has something to do with the firewall.

I'd just like to connect, using port 21 and a passive connection. I'd like to open ports 39000 through 40000 for the passive connection.

What do I do?


AHA! I fixed it! I took another look at the rules and marked down which number rule that reject one was. I had a hunch it was blocking the rules after it, and it was!

So, it was the following rule that was blocking my connections:

49907 7084K REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited

So what I did to fix it, was restart the server which reset the rules, and then added my port 21 rule to be before that reject rule:

 sudo iptables -I RH-Firewall-1-INPUT 11 -p tcp -m tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
 sudo iptables -I RH-Firewall-1-INPUT 11 -p tcp -m tcp --dport 39000:40000 -m state --state RELATED,ESTABLISHED -j ACCEPT

Then, I added the following to my vsftpd.conf:

pasv_enable=YES
pasv_max_port=39000
pasv_min_port=40000

Now I can connect, hooray!

share|improve this question
    
At first glance, you're not allowing port 20, which is ftp-data. However your question does state you want to do a passive connection, which only uses port 21, so this might not be the issue. Just wanted to make sure. Anyway, the second thing is can you use iptables -nvL for the output? Just doing iptables -L hides a lot of important info. –  Patrick May 21 at 4:48
    
Alright, I'll try to get some better info. –  Zaemz May 21 at 5:00
    
@Patrick I've updated the iptables with the flags that you requested. –  Zaemz May 21 at 18:36

1 Answer 1

up vote 1 down vote accepted

Here's my answer from the question:


AHA! I fixed it! I took another look at the rules and marked down which number rule that reject one was. I had a hunch it was blocking the rules after it, and it was!

So, it was the following rule that was blocking my connections:

49907 7084K REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited

So what I did to fix it, was restart the server which reset the rules, and then added my port 21 rule to be before that reject rule:

 sudo iptables -I RH-Firewall-1-INPUT 11 -p tcp -m tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
 sudo iptables -I RH-Firewall-1-INPUT 11 -p tcp -m tcp --dport 39000:40000 -m state --state RELATED,ESTABLISHED -j ACCEPT

Then, I added the following to my vsftpd.conf:

pasv_enable=YES
pasv_max_port=40000
pasv_min_port=39000

Now I can connect, hooray!

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.