We are developing a Magento application that has a module that works with FTP. Today we deployed this on the testing environment which is setup in the following way:

Gateway server which has the following iptables rules:

    # iptables -L -n -v
Chain INPUT (policy ACCEPT 2 packets, 130 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
  165 13720 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 

Chain FORWARD (policy ACCEPT 7 packets, 606 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  eth1   eth0    0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
   15   965 ACCEPT     all  --  eth0   eth1    0.0.0.0/0            0.0.0.0/0           
    0     0 REJECT     all  --  eth1   eth1    0.0.0.0/0            0.0.0.0/0           reject-with icmp-port-unreachable 

Chain OUTPUT (policy ACCEPT 126 packets, 31690 bytes)
 pkts bytes target     prot opt in     out     source               destination      

These are set at runtime via the following bash script:

#!/bin/sh

PATH=/usr/sbin:/sbin:/bin:/usr/bin

#
# delete all existing rules.
#
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X

# Always accept loopback traffic
iptables -A INPUT -i lo -j ACCEPT

# Allow established connections, and those not coming from the outside
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow outgoing connections from the LAN side.
iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT

# Masquerade.
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

# Don't forward from the outside to the inside.
iptables -A FORWARD -i eth1 -o eth1 -j REJECT

# Enable routing.
echo 1 > /proc/sys/net/ipv4/ip_forward

The gateway server is connected to the WAN via eth1 and is connected to the internal network via eth0.

One of the servers from eth1 has the following problem when trying to list files over ftp:

$ ftp -vd myftpserver.com
Connected to myftpserver.com
220 Welcome to MY FTP Server
ftp: setsockopt: Bad file descriptor
Name (myftpserver.com:magento): XXXXXXXX
---> USER XXXXXXXX
331 User XXXXXXXX, password please
Password:
---> PASS XXXX
230 Password Ok, User logged in
---> SYST
215 UNIX Type: L8
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
ftp: setsockopt (ignored): Permission denied
---> PORT 192,168,19,15,135,75
421 Service not available, remote server has closed connection

When I try listing the files in passive mode, same result.

When I run the same command on the gateway server, everything works fine so I believe that the issue is happening because of the iptables rules not forwarding properly.

Does anyone have an idea which rule I need to add to make this work?