I've installed debian (on my raspberry, but the question is quite generic):
Linux raspberrypi 4.9.28+ #998 Mon May 15 16:50:35 BST 2017 armv6l GNU/Linux
And I'm trying to set up a simple anonymous and plaintext (no SSL) FTP server on it (vsftpd). The TCP port is the regular 21 FTP port, and I'm going to allow only passive mode.
I would like to have a strict firewall configuration, so I'm allowing in only ssh and the aforementioned FTP server.
For this purpose I'm using the
conntrack module to allow only legit
inbound connections. For this reason I loaded with
My iptables configuration:
# Generated by iptables-save v1.4.21 on Sat Aug 12 15:50:44 2017 *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [108:11273] -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT -A INPUT -p tcp -m tcp --dport 21 -j ACCEPT -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A INPUT -j DROP COMMIT # Completed on Sat Aug 12 15:50:44 2017
With this configuration I'm not able to get the passive data connection to work properly.
I've both set up a tcpdump and added a
-A INPUT j LOG rule just before the
-A INPUT -j DROP: I can clearly see the inbound packets for the Iptablespassive
data connection to be logged and rejected.
Some time ago I did pretty much the same setup on a Centos7 machine, where it worked correctly. Am I missing something important?
Thanks for any help :)