FTP Access Through IPTABLES Firewall

SlowCoder · 04-12-2007, 04:15 PM

I have port 21 allowed outgoing through my firewall. This allows me to establish a connection to the FTP server, and log in, but I cannot transfer files. This is due to the outside FTP server attempting to establish a new connection to my client. I don't think I want to just allow incoming port 20 access through my firewall to all of my clients on a general basis.

Most of my clients are Windows, and browsers, so I don't think I have a choice to select PASV mode.

What can I do to my IPTables firewall to allow connections?

rednuht · 04-12-2007, 04:32 PM

there is a kernel module for this
after a quick google I found this http://www.linuxhomenetworking.com/w...Using_iptables

Quote:

The iptables application requires you to load certain kernel modules to activate some of its functions. Whenever any type of NAT is required, the iptable_nat module needs to be loaded. The ip_conntrack_ftp module needs to be added for FTP support and should always be loaded with the ip_conntrack module which tracks TCP connection states. As most scripts probably will keep track of connection states, the ip_conntrack module will be needed in any case. The ip_nat_ftp module also needs to be loaded for FTP servers behind a NAT firewall.

Unfortunately, the /etc/sysconfig/iptables file doesn't support the loading of modules, so you'll have to add the statements to your /etc/rc.local file which is run at the end of every reboot.

The script samples in this chapter include these statements only as a reminder to place them in the /etc/rc.local file

# File: /etc/rc.local

# Module to track the state of connections
modprobe ip_conntrack

# Load the iptables active FTP module, requires ip_conntrack
modprobe ip_conntrack_ftp

# Load iptables NAT module when required
modprobe iptable_nat

# Module required for active an FTP server using NAT
modprobe ip_nat_ftp