Linux

Ask something
Discussion Locked

problem with FTP connection with iptable

0 helpful
8 replies

by abubin 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi all,

I just configured my iptables to share my ADSL connection on the LAN. But there seems to be problems with connecting to FTP through NAT. It seems that I definitely need to enable PASV(passive) mode to make the ftp connection works.

When using win2k's IE5 to connect to FTP, it won't work because there is no PASV mode for it. I get Invalid port command error. But somehow, my own PC can FTP with IE. Very strange!!!

Ok, here is my list of IPTABLES -L

Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- 202.x.x.x anywhere
ACCEPT tcp -- 210.x.x.x anywhere tcp dpt:ssh
ACCEPT tcp -- 192.168.10.0/24 anywhere tcp dpt:squid
ACCEPT tcp -- 192.168.10.0/24 anywhere tcp dpt:8888
block all -- anywhere anywhere
DROP all -- !192.168.10.0/24 anywhere

Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- 192.168.10.50 anywhere
ACCEPT all -- 192.168.10.0/28 anywhere
DROP all -- 192.168.10.0/24 anywhere
block all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Chain block (2 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere state NEW
DROP all -- anywhere anywhere

the one with 210.x.x.x is ip for ADSL connection and the other 202.x.x.x is allowing that server to connect to this server.

My own pc have ip of 192.168.10.11.

Please help! Thanks in advance.

8 replies

by networq

you will need to enable incomming connections to port 20 (also known as ftp-data) for both tcp and udp. an example is:

iptables -A INPUT -p tcp -s 0/0 -d 0/0 --dport 20 -j ACCEPT

The above script should allow ftp transfers from any ftp server to any computers on your private network.

if you need to limit the host(s) that ftp transfers are allot from, replace the source address (-s 0/0) with the ip adress / netmask of the server.

by spidererrol

I would try "modprobe ip_conntrack_ftp" and "modprobe ip_nat_ftp" (the latter if you are masqurading).

I have found that these do not always get loaded by iptables and solved similar problems on some machines.

If manually loading them helps, just add them into /etc/rc.d/rc.local to ensure they always get loaded.

by gregory pleau

I had the same issues - you have to put this in iptables :

iptables -A INPUT -p tcp --sport 21 -m state --state ESTABLISHED-j ACCEPT
iptables -A OUTPUT-p tcp --dport 21 -m state --state NEW,ESTABLISHED-j ACCEPT

Of course you still need to use ip_conntrack and ip_conntrack_ftp as the above stated. Another slim possibility is the MTU of the ADSL connection ( try "ipconfig eth# mtu 1412" to test) Replace # with the interface number

This discussion is closed to new replies.