LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 02-17-2013, 02:38 AM   #1
slackin1stimer
LQ Newbie
 
Registered: Dec 2012
Distribution: Slackware-14 64
Posts: 6

Rep: Reputation: Disabled
vsftpd and iptables won't play together


In a nutshell I am unable to access my vsftp server while my firewall is active despite opening the correct ports--AFAIK. I recently switched my home server from CentOS 6.3 to Slackware 14. I am using the same iptables configuration as before, but now I have a quirk. I am by no means skilled at using iptables--I simply followed the suggestions on the CentOS wiki as follows:
# iptables -P INPUT ACCEPT
# iptables -F
# iptables -A INPUT -i lo -j ACCEPT
# iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# iptables -A INPUT -p tcp --dport 22 -j ACCEPT
(Added by me) -A INPUT -p tcp -s 192.168.1.0/24 --dport 80 -j ACCEPT
(Added by me) -A INPUT -p tcp --dport 21 -j ACCEPT
# iptables -P INPUT DROP
# iptables -P FORWARD DROP
# iptables -P OUTPUT ACCEPT
# iptables -L -v

Now with the above setup I can remotely access my webserver and ssh no problem, but not vsftpd. I am able to access vsftpd from the server itself but remote access is the whole point If I remove the "iptables -P INPUT DROP" line then vsftpd becomes accessible. I googled several sources regarding opening up the correct ports in iptables to allow access to vsftpd and am pretty sure I entered the correct info. I would like to be able to use my firewall and vsftpd at the same time. Any help or shove in the right direction would be greatly appreciated. I am really stumped by this one and it pains me to have to go to bed with this unsolved, but mine eyes are tired and the screen be fuzzy.
 
Old 02-17-2013, 09:28 AM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 26,953
Blog Entries: 54

Rep: Reputation: 2732Reputation: 2732Reputation: 2732Reputation: 2732Reputation: 2732Reputation: 2732Reputation: 2732Reputation: 2732Reputation: 2732Reputation: 2732Reputation: 2732
Active FTP requires minimally TCP/21 (control) and TCP/20 (data). FTPS uses TCP/990. For PASV mode also see the pasv* settings in vsftpd .conf:
Code:
INPUT -P ACCEPT
FORWARD -P DROP
OUTPUT -P ACCEPT
INPUT -i lo -j ACCEPT
INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
INPUT -m state --state NEW -m limit --limit 3/s -j LOG --log-prefix "IN_inv "
INPUT -m state --state INVALID -j REJECT
INPUT -p tcp -s 192.168.1.0/24 -m state --state NEW --dport 80 -j ACCEPT
INPUT -p tcp -m multiport --dports 20:22,990 -m state --state NEW -j ACCEPT
INPUT -m state --state NEW -m limit --limit 3/s -j LOG --log-prefix "IN_rej "
INPUT -m state --state NEW -j REJECT
*You need to add some ICMP rules to the above.

**BTW if you post iptables rules it's better to post output of 'iptables-save'.

Last edited by unSpawn; 02-17-2013 at 09:30 AM.
 
Old 02-17-2013, 04:08 PM   #3
slackin1stimer
LQ Newbie
 
Registered: Dec 2012
Distribution: Slackware-14 64
Posts: 6

Original Poster
Rep: Reputation: Disabled
Doh!

I think I found the problem. While googling I noticed a few posts re: CentOS and needing to "modprobe ip_conntrack_ftp" so I tried it and that has solved my problem. Slackin' off always teaches me something

And of course to enable the module at boot one can edit /etc/rc.d/rc.modules which thankfully included a line for ip_conntrack_ftp that only needed to be uncommented

Last edited by slackin1stimer; 02-17-2013 at 04:32 PM. Reason: Thoroughness
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
VLC will play DVD, but won't play ISO airman99 Linux - Software 9 01-16-2013 04:51 AM
audio cds won't mount/play but dvds in same drives play. Running SW12.2current. lestoil Slackware 6 05-28-2009 07:33 PM
vsftpd won't read vsftpd.conf m2azer Linux - Software 9 04-21-2006 03:25 PM
Kaffeine, won't play a DVD but will play individual VOB files? GameGuru Linux - Newbie 12 07-08-2005 12:33 AM


All times are GMT -5. The time now is 09:45 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration