There’s lots of advice on the net about how to setup a server with iptables to allow passive mode FTP. Below is the approach that we’ve found to be most effective.
Start by configuring your FTP daemon to use a fixed range of ports. We use 41361 to 65534 which is the IANA registered ephemeral port range. The exact config depends on what FTP software you’re using:
vsftpd
Edit /etc/vsftpd/vsftpd.conf and add the following lines:
|
1 2 |
pasv_min_port=49152 pasv_max_port=65534 |
proftpd
Edit /etc/proftpd.conf and add to the Global section:
|
1 2 3 |
...... PassivePorts 49152 65534 |
Now restart your FTP service so the changes take effect.
Next you’ll need to configure the ip_conntrack_ftp iptables module to load. On Redhat/CentOS just edit /etc/sysconfig/iptables-config and add “ip_conntrack_ftp” to the IPTABLES_MODULES like this:
|
1 2 |
IPTABLES_MODULES="ip_conntrack_ftp" |
Next edit /etc/sysconfig/iptables and add a rule to allow TCP port 21. The new line is marked in red:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 |
*filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT -A INPUT -j REJECT --reject-with icmp-host-prohibited -A FORWARD -j REJECT --reject-with icmp-host-prohibited COMMIT |
Now restart the iptables service:
|
1 2 |
/sbin/service iptables restart |
You can verify that the correct port range has been registered with lsmod like this:
|
1 2 |
lsmod | grep conntrack_ftp |
and you’ll get something like this:
|
1 2 3 |
ip_conntrack_ftp <strong>41361</strong> 0 ip_conntrack 91621 2 ip_conntrack_ftp,xt_state |
And that’s all it takes to get passive mode ftp working behind iptables.
One extra note: If your server is NATed behind a physical firewall then you’ll probable need to load the “ip_nat_ftp” iptables module.
On a AWS EC2 server with vsftpd I had to add “pasv_address=x.x.x.x” to the /etc/vsftpd/vsftpd.conf file where x.x.x.x was the public (elastic) address of the server. On an AWS EC2 server with Plesk and proftpd I had to add “MasqueradeAddress x.x.x.x” to a new file at /etc/proftpd.d/1-pasv_addr.conf.
13 Responses
Solved my issue with the Extra note. iptables-config was missing the module ip_nat_ftp.
essaie ceci:
export IPT=’sudo /sbin/iptables’
$IPT -A INPUT -m state –state NEW,RELATED -p tcp ! –tcp-flags ALL SYN -j DROP
$IPT -A INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT
# http + ftp + active ftp + pasv ftp
$IPT -A OUTPUT -p tcp –dport 80 -m state –state ESTABLISHED,NEW -j ACCEPT
$IPT -A OUTPUT -p tcp –dport 21 -m state –state ESTABLISHED,NEW -j ACCEPT
$IPT -A OUTPUT -p tcp –dport 20 -m state –state ESTABLISHED -j ACCEPT
$IPT -A OUTPUT -p tcp –dport 50000:60000 -m state –state RELATED,ESTABLISHED -j ACCEPT
Works like a charm ;D
[root@development ~]# lsmod | grep conntrack_ftp
nf_conntrack_ftp 12913 0
nf_conntrack 79645 3 nf_conntrack_ftp,nf_conntrack_ipv4,xt_state
[root@development ~]#
[root@development ~]#
[root@development ~]# service iptables restart
iptables: Flushing firewall rules: [ OK ]
iptables: Setting chains to policy ACCEPT: filter [ OK ]
iptables: Unloading modules: [ OK ]
iptables: Applying firewall rules: [ OK ]
iptables: Loading additional modules: ”nf_conntrack_ftp” [FAILED]
Any ideas?
What linux/kernel version?
Your’s if referencing nf_conntrack_ftp instead of ip_conntrack_ftp but I don’t know what the difference is.
make sure you have these line:
IPTABLES_MODULES=”ip_conntrack_ftp”
(not nf_conntrack_ftp)
Sure some versions require ip_conntrack_ftp instead of nf_conntrack_ftp.
Work with IPv6 too. I have added “ip_conntrack_ftp” to /etc/modules. Thanks!.
iptables -N T_FTP
iptalbes -A T_FTP -p tcp -m multiport –dport 20,21 -s x.x.x.x/24 -m state –state NEW -m limit –limit-burst 20 –limit 7/s -j LOG –log-prefix “[T_FTP]”
iptables -A T_FTP -p tcp -m multiport –dport 20,21 -s x.x.x.x/24 -m state –state NEW,ESTABLISHED -j ACCEPT
iptables -A T_FTP -p tcp -m multiport –dport 20,21 -s x.x.x.x/24 -m state –state ESTABLISHED,RELATED -j ACCEPT
iptables -A T_FTP -p tcp –dport 1024:65535 -s x.x.x.x/24 -m state –state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A T_FTP -p tcp –sport 1024:65535 -d x.x.x.x/24 -m state –state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -j T_FTP
iptables -A T_FTP -m multiport –sport 20,21 -d x.x.x.x./24 -m state –state ESTABLISHED,RELATED -j ACCEPT