ftp server ports

kola · 07-21-2004, 04:24 AM

Hi, just trying to get my head around ftp and how to allow connections to a server. I have an ftp deamon running which looks for connections on port 21.

So, I figure i need to at least accept connections on this port? Then i need to enable another port(s) for the data channel, yes? This depends on whether we are using active or passive transfers....this is where i get confused.

Passive is more dangerous to the server but more client-friendly from what i can make out. I also read i think that the ip_conntrack_ftp module can read what ports the clients want to use and open them accordingly, instead of having to open the whole upper range. Is this correct?

It would be great if someone with an ftp server could show me just the few lines that are used for ftp connections. My firewall is still basic but im building on it slowly and this would help get the low stumbling blocks out the way.

cheers

ps: the ftp server is on the gateway machine, using iptables. 1.2.5

ppuru · 07-21-2004, 04:53 AM

This link was posted by Capt_Caveman. I think it will answer all your queries. It is for client connections but you would be able to modify those rules for your ftp server connections.

kola · 07-21-2004, 06:07 AM

I have to admit i dont completely understand everything hes writing here.

Whats the difference between an sport and a dport?

ppuru · 07-21-2004, 06:26 AM

sport is the source port - the port from where the packet originates
dport is the destination port - the port that the packet si destined for.

Your iptable rule to allow passive ftp-data should be like

Code:

iptables -A INPUT -i <external interface> -p tcp --dport 1024: -j ACCEPT -m state --state RELATED,ESTABLISHED
iptables -A OUTPUT -o <external interface> -p tcp --dport 1024: -j ACCEPT

kola · 07-21-2004, 06:42 AM

Ah ok, so before that i need something for the port 21 too?

Code:

iptables -A INPUT -i ppp0 -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o ppp0 -p tcp --dport 21 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

Something like that?

kola · 07-23-2004, 03:10 AM

Well, i got passive ftp working with this:

Code:

$IPTABLES -A INPUT -i ppp0 -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A OUTPUT -o ppp0 -p tcp --dport 21 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -i ppp0 -p tcp --dport 1024: -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A OUTPUT -o ppp0 -p tcp --dport 1024: -j ACCEPT

The third line is apparently supposed to work without the NEW according to the link posted above,but, well it doesnt
So as far as i can tell, what this is doing is showing all ports > 1024 as closed? How safe is this? Will it let any NEW packet in, or does it only allow NEW packets that have previously been ok'd through port 21?

If someone could clear up my confusion or post something that works better that would be great

thanks

ppuru · 07-23-2004, 07:14 AM

you are right kola, the NEW state is required.

If you are using vsftpd, you can set the pasv_max_port and pasv_min_port to regulate data connections to those ports and fine tune your firewall rules like

Code:

$IPTABLES -A INPUT -i ppp0 -p tcp --dport 54776:54875 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT