Enabling FTP

r3sistance · 10-18-2007, 06:05 PM

I am currently setting up a Linux Server I have recently built and have used yum to install vsftpd on to it, however I am currently unable to open an external FTP connection to this machine.

I am thinking what I am putting into iptables is the problem, so I am wondering what I should be putting in to bring up ftp securely. Any help would be appreciated.

win32sux · 10-18-2007, 06:25 PM

Just open TCP port 21 and have a rule for RELATED and ESTABLISHED packets.

Example:

Code:

iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -p TCP --dport 21 -m state --state NEW -j ACCEPT

Also make sure you load the ip_conntrack_ftp helper module unless you compiled it in.

r3sistance · 10-18-2007, 06:43 PM

Thanks for the quick reply, That's modprobe ip_conntrack_ftp right? I am not experienced with Linux unforantly, mainly used GUIs in the past to my some what shame...

Darn thing still doesn't wanna establish connections with other machines for FTP =/... can FTP it from itself but I am guessing it's still firewalling it... SSHed into a machine on the same site so there shouldn't be anything between those two machines that would block FTP at all. Is their anything (stupidly) obvious I should check?

win32sux · 10-18-2007, 06:45 PM

Yes, you'd use modprobe. Can you post your active iptables configuration?

Code:

iptables -nvL

Please use code tags when you do so.

r3sistance · 10-18-2007, 06:52 PM

Ok

Code:

[root@synbios ~]# iptables -nvL
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination                                                                                                                      
  667 64730 RH-Firewall-1-INPUT  all  --  *      *       0.0.0.0/0            0.                                                                                                                     0.0.0/0

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination                                                                                                                      
    0     0 RH-Firewall-1-INPUT  all  --  *      *       0.0.0.0/0            0.                                                                                                                     0.0.0/0

Chain OUTPUT (policy ACCEPT 501 packets, 89113 bytes)
 pkts bytes target     prot opt in     out     source               destination                                                                                                                      

Chain RH-Firewall-1-INPUT (2 references)
 pkts bytes target     prot opt in     out     source               destination                                                                                                                      
   88  5734 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0                                                                                                                        
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0                                                                                                                                icmp type 255
    0     0 ACCEPT     esp  --  *      *       0.0.0.0/0            0.0.0.0/0                                                                                                                        
    0     0 ACCEPT     ah   --  *      *       0.0.0.0/0            0.0.0.0/0                                                                                                                        
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            224.0.0.251                                                                                                                              udp dpt:5353
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0                                                                                                                                udp dpt:631
  414 32899 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0                                                                                                                                state RELATED,ESTABLISHED
    2   104 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0                                                                                                                                state NEW tcp dpt:22
  163 25993 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0                                                                                                                                reject-with icmp-host-prohibited

I tried those two lines you gave me, and various other things and I swear the information in iptables isn't changing... but meh, my Linux knowledge sucks unforantly ^^;;.

win32sux · 10-18-2007, 07:06 PM

Quote:

Originally Posted by r3sistance

I tried those two lines you gave me, and various other things and I swear the information in iptables isn't changing... but meh, my Linux knowledge sucks unforantly ^^;;.

Yeah, they were meant as examples which would have to be tailored to your setup.

In any case, this should do the trick (from what I see in your post):

Code:

iptables -I RH-Firewall-1-INPUT -p TCP --dport 21 -m state --state NEW -j ACCEPT

You don't need the RELATED,ESTABLISHED rule I posted because you already have one set.

r3sistance · 10-18-2007, 07:17 PM

Quote:

Originally Posted by win32sux

Yeah, they were meant as examples which would have to be tailored to your setup.

In any case, this should do the trick (from what I see in your post):

Code:

iptables -I RH-Firewall-1-INPUT -p TCP --dport 21 -m state --state NEW -j ACCEPT

You don't need the RELATED,ESTABLISHED rule I posted because you already have one set.

errr... sorry about that then ^^;;... anyway thanks, that seems to have done the job nicely. I really need to learn Linux correctly one of these days

.

win32sux · 10-18-2007, 08:12 PM

Glad it worked.

BTW, remember that for this config to survive a reboot you need to do a:

Code:

service iptables save

r3sistance · 10-19-2007, 12:36 PM

Hmm ok. Thanks, this machine is mainly for development purposes so it's not a major thing needing FTP up all time anyway ^^;;.