iptables: connect to a FTP server

the_gripmaster · 05-20-2008, 05:51 AM

On my mail server I am running iptables with a default policy of DROP:

Code:

/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT DROP
/sbin/iptables -P FORWARD DROP

Now I am trying to connect to my FTP server (192.168.100.12) from my mail server using the rules below:

Code:

/sbin/iptables -A INPUT -i eth0 -p tcp -s 192.168.100.12 --sport ftp -m state --state NEW,ESTABLISHED -j ACCEPT
/sbin/iptables -A OUTPUT -o eth0 -p tcp -d 192.168.100.12 --dport ftp -m state --state NEW,ESTABLISHED -j ACCEPT
/sbin/iptables -A INPUT -i eth0 -p tcp -s 192.168.100.12 --sport ftp-data -m state --state NEW,ESTABLISHED -j ACCEPT
/sbin/iptables -A OUTPUT -o eth0 -p tcp -d 192.168.100.12 --dport ftp-data -m state --state NEW,ESTABLISHED -j ACCEPT

I can connect fine. But when I run any command like dir, I get the following error after a long delay:

Code:

ftp> dir
227 Entering Passive Mode (192,168,100,12,113,135)
ftp: connect: Connection timed out

Turning passive mode off, I get (after a long delay):

Code:

ftp> passive
Passive mode off.
ftp> dir
200 PORT command successful. Consider using PASV.
425 Failed to establish connection.

Do I have to add any additional rule for iptables?

win32sux · 05-20-2008, 06:05 AM

For an FTP server you just need something like this:

Code:

iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

iptables -A INPUT -p TCP -i eth0 --dport 21 \
-m state --state NEW -j ACCEPT

iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

If that doesn't work, you need to check whether you have the FTP connection tracking module loaded, which you will need unless you have FTP connection tracking support compiled into your kernel. IIRC it's called ip_conntrack_ftp.

EDIT: I re-read your post and it seems you are talking about the iptables rules on the box which would be the FTP client instead of the server. In that case, you'd use this instead:

Code:

iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

iptables -A OUTPUT -p TCP -o eth0 --dport 21 \
-m state --state NEW -j ACCEPT

The need for FTP connection tracking still applies, though.