1

when using ftp via commandline I can connect and authenticate but when I issue commands I receive the message connection refused. I am able to connect to this FTP server from other servers and locally with a windows FTP client. I believe it is an iptables issue but can't crack it

centos7

iptables -L -n

Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            ctstate NEW tcp dpt:20
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            ctstate NEW tcp dpt:21
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0            ctstate NEW udp dpt:20
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0            ctstate NEW udp dpt:21
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp spts:1024:65535 dpts:1024:65535 state NEW,RELATED,ESTABLISHED

ftp output

Connected to ftpserver.com
220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------
220-You are user number 6 of 500 allowed.
220-Local time is now 11:40. Server port: 21.
220-This is a private system - No anonymous login
220 You will be disconnected after 15 minutes of inactivity.
Name (ftpserver.com:root): user@ftpserver.com
331 User user@ftpserver.com OK. Password required
Password:
230-Your bandwidth usage is restricted
230 OK. Current restricted directory is /
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
227 Entering Passive Mode (107,180,25,79,195,132)
ftp: connect: Connection refused
ftp>

iptables/sysconfig

-A INPUT ! -i lo -p tcp -m conntrack --ctstate NEW -m tcp --dport 20 -j ACCEPT
-A INPUT ! -i lo -p tcp -m conntrack --ctstate NEW -m tcp --dport 21 -j ACCEPT
-A INPUT ! -i lo -p udp -m conntrack --ctstate NEW -m udp --dport 20 -j ACCEPT
-A INPUT ! -i lo -p udp -m conntrack --ctstate NEW -m udp --dport 21 -j ACCEPT

-A OUTPUT ! -o lo -p tcp -m conntrack --ctstate NEW -m tcp --dport 20 -j ACCEPT
-A OUTPUT ! -o lo -p tcp -m conntrack --ctstate NEW -m tcp --dport 21 -j ACCEPT
-A OUTPUT ! -o lo -p udp -m conntrack --ctstate NEW -m udp --dport 20 -j ACCEPT
-A OUTPUT ! -o lo -p udp -m conntrack --ctstate NEW -m udp --dport 21 -j ACCEPT
  • 4
    Maybe you should run modprobe -v nf_conntrack_ftp on the CentOS machine and load the module. – Valentin Bajrami Apr 2 at 9:34
  • That did the trick.FTP working as expected. – chrisrth Apr 2 at 11:26
  • 1
    a note: a stateful rule using port 20 is most certainly wrong or misleading. the ftp helper would handle anything related to port 20 except that with passive FTP there is never a port 20 involved anyway (i.e.: you can remove any reference to port 20 in your rules) – A.B Apr 2 at 16:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.