[SOLVED] need help making sense of this iptable rule that's blocking ftp

jzoudavy · 08-24-2015, 08:59 AM

Hi experts

I got the following set of rules:

Code:

# iptables --list
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere state 
RELATED,ESTABLISHED
ACCEPT icmp -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT tcp -- anywhere anywhere state NEW 
tcp dpt:telnet
ACCEPT tcp -- anywhere anywhere state NEW 
tcp dpt:ssh
REJECT all -- anywhere anywhere reject-with 
icmp-host-prohibited
ACCEPT tcp -- anywhere anywhere tcp dpt:ftp 
ctstate ESTABLISHED /* Allow ftp connections on port 21 */

Chain FORWARD (policy ACCEPT)
target prot opt source destination
REJECT all -- anywhere anywhere reject-with 
icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

But for some reason, it blocks FTP on port 21. which is weird because the line where it is suppose to allow FTP. And ping and ssh are still allowed.

Can anyone help me make sense of why that is?

Thanks

rknichols · 08-24-2015, 10:50 AM

Why do you have a "ctstate ESTABLISHED" qualifier on that rule. That's not going to allow new connections, and packets for ESTABLISHED connections were already allowed in the "state RELATED,ESTABLISHED" rule above.

And please, when posting iptables rule sets, include the "-v" option with "--list" (or "-L"), or else just post the output from "iptables save". Without that, the "in" and "out" interface qualifiers are not shown, making the ruleset sometimes incomprehensible.

jzoudavy · 08-24-2015, 12:04 PM

ok thanks