Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

i want to allow incoming FTP traffic.

CentOS 5.4:

This is my /etc/sysconfig/iptables file.

# Generated by iptables-save v1.3.5 on Thu Oct  3 21:23:07 2013
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [133:14837]
-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
-A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-port-unreachable
-A OUTPUT -p tcp -m tcp --sport 20 -j ACCEPT
COMMIT
# Completed on Thu Oct  3 21:23:07 2013

Also, by default, ip_conntrack_netbios_n module is getting loaded.

#service iptables restart

Flushing firewall rules:                                   [  OK  ]
Setting chains to policy ACCEPT: filter                    [  OK  ]
Unloading iptables modules:                                [  OK  ]
Applying iptables firewall rules:                          [  OK  ]
Loading additional iptables modules: ip_conntrack_netbios_n[  OK  ]

But the problem is not with that module, as i tried unloading it and still no luck.

If i disable iptables, I am able to transfer my backup from another machine to FTP. If iptables is enforcing, then transfer failed.

Please advise.

share|improve this question

2 Answers 2

up vote 8 down vote accepted

Your ftp server needs a channel to transfer data. Port 21 is used to establish the connection. So to make data transfer possible you'd need to enable port 20 as well. See the following configuraton

First load the following module to make sure passive ftp connections are not rejceted

modprobe ip_conntrack_ftp

Allow FTP connections on port 21 incoming and outgoing

iptables -A INPUT  -p tcp -m tcp --dport 21 -m conntrack --ctstate ESTABLISHED -j ACCEPT -m comment --comment "Allow ftp connections on port 21"
iptables -A OUTPUT -p tcp -m tcp --dport 21 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT -m comment --comment "Allow ftp connections on port 21"

Allow FTP port 20 for active connections incoming and outgoing

iptables -A INPUT  -p tcp -m tcp --dport 20 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT -m comment --comment "Allow ftp connections on port 20"
iptables -A OUTPUT -p tcp -m tcp --dport 20 -m conntrack --ctstate ESTABLISHED -j ACCEPT -m comment --comment "Allow ftp connections on port 20"

Finally allow FTP passive inbound traffic

iptables -A INPUT  -p tcp -m tcp --sport 1024: --dport 1024: -m conntrack --ctstate ESTABLISHED -j ACCEPT -m comment --comment "Allow passive inbound connections"
iptables -A OUTPUT -p tcp -m tcp --sport 1024: --dport 1024: -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT -m comment --comment "Allow passive inbound connections"

For more on FTP and firewall problems see: http://slacksite.com/other/ftp.html#active

share|improve this answer
1  
I forgot to mention that --sport 1024: and --dport 1024: mean that we are including all ports in the range 1024:32535 which are unprivileged ports, meaning that users with no privilege access can use these ports to test their applications. –  val0x00ff Oct 4 '13 at 12:11
    
@Being Gokul, That's correct. We can control our server on what ports it should listen for client connections. However in a passive mode, we must use --sport to be an unprivileged mode to privent firewall problems and let clients connect to the server. –  val0x00ff Oct 4 '13 at 12:21
    
Still no luck. Have a doubt. --ctstate ESTABLISHED ... does it allow new connections? should we modify it by saying ESTABLISHED,NEW ? –  Being Gokul Oct 4 '13 at 12:40
1  
Well, you can add NEW,ESTABLISHED but that shouldn't matter. A connection is first always in a NEW state then it jumps to RELATED which indicates that this connection is related to an already permitted connection. When the connection changes to ESTABLISHED state it informs us that a connection has been established on both sides (server / client). You might try -m state --state ... instead. –  val0x00ff Oct 4 '13 at 12:50
    
Please check the answer by me and let me know if rules are correct. Thank you so much. –  Being Gokul Oct 4 '13 at 13:06

Adding NEW fixed it, I believe.

Now, my iptables file look like this..

# Generated by iptables-save v1.3.5 on Thu Oct  3 22:25:54 2013
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [824:72492]

-A INPUT -p tcp -m tcp --dport 21 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 20 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --sport 1024:65535 --dport 20:65535 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-port-unreachable
-A OUTPUT -p tcp -m tcp --dport 21 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 20 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 1024:65535 --dport 20:65535 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
COMMIT
# Completed on Thu Oct  3 22:25:54 2013

Typing it as answer, since too many characters are not allowed in comment.. Thank you so much for your help.

share|improve this answer
1  
Cool it worked and glad I pointed you to the right direction. Please mark your own answer as solved so you help other people who seek for the right answer. –  val0x00ff Oct 4 '13 at 13:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.