I have a little problem with my iptables firewall script:

I have set up a ftp server (vstpd) on my linux box.
The ftp server runs on port 50021, and is set in passive mode.
The ports for passive mode are limited from 20000 to 50000

I can connect to the ftp server, but I get a listing error. (Probably because the passive ports are blocked on my ftp server)

Here is a log from my ftp client:

....
[R] 230 Login successful.
[R] SYST
[R] 215 UNIX Type: L8
[R] FEAT
[R] 211-Features:
[R] EPRT
[R] EPSV
[R] MDTM
[R] PASV
[R] REST STREAM
[R] SIZE
[R] TVFS
[R] 211 End
[R] PWD
[R] 257 "/home/yvesg"
[R] TYPE A
[R] 200 Switching to ASCII mode.
[R] PASV
[R] 227 Entering Passive Mode (84,194,48,3,150,5)
[R] Opening data connection IP: 84.194.48.3 PORT: 38405
[R] Data Socket Error: Connection timed out
[R] List Error
.....

In my firewall script I have loaded the ip_conntrack_ftp and ip_nat_ftp modules.

I also implemented the following lines:

#Loading necessary modules
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_nat_ftp

#Opening ports 50021 50022 50080
${IPTABLES} -A INPUT -i eth0 -p tcp --dport 50021 -m state --state NEW,ESTABLISHED -j ACCEPT
${IPTABLES} -A INPUT -i eth0 -p tcp --dport 50022 -m state --state NEW,ESTABLISHED -j ACCEPT
${IPTABLES} -A INPUT -i eth0 -p tcp --dport 50080 -m state --state NEW,ESTABLISHED -j ACCEPT

#Setting rules for connection tracking
${IPTABLES} -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT
${IPTABLES} -A INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT


what is wrong ?

The iptables helper ip_conntrack_ftp monitors the data stream between ftp client and ftp server in order to determine which additional ports have to be opened for the connection.

It expects that this conversation takes place on the default ftp port (21).

You are using a different port, and ip_conntack_ftp does not know that. It still monitors port 21, blissfully unaware of anything else around it.

Use the following to tell the helper app an which port your ftp connection will take place:

FYI: (not necessary in this case) ports can take more than one argument. Use ports=X,Y,Z

Tried to implement this in the firewall script, but the problem still exists

fixed it myself

It seems that the module still needs the original ftp port
So the command needs to be:

modprobe ip_conntrack_ftp ports=21,50021