How to get Passive FTP Working Through an Iptables Firewall?
- by user1133248
I have an iptables firewall running on a Fedora Linux server that is basically being used as a firewall router and OpenVPN server. That's it. We have been using the same iptables firewall code for YEARS. I did make some changes on 21 December to re-route a mySQL port, but given what has happened I've completely backed those changes out. Sometime after those changes were made and backed out passive FTP, served from a vsftpd process, stopped working. We use a passive ftp client to FLING (that's the name of the ftp client running under Windows! :-) ) images from our remote telescopes to our server.
I believe it is something in the firewall code because I can drop the firewall and the FTP file transfer (and connecting to the ftp site with Internet Explorer to see the file list) works. When I raise the iptables firewall, it stops working.
Again, this is code that we'd been using for years. However, I felt that maybe there was something I missed, so we had a .bak file from 2009 that I used. Same behavior, passive ftp does not work.
So, I went and rebuilt the firewall code line by line to see what line was causing the problem. Everything worked until I put the line
-A FORWARD -j DROP
in very near the end. Of course, if I am correct, this is the line that basically "turns on" the firewall, saying drop everything except for the exceptions I've made above. However, this line has been in the iptables code probably since 2003.
So, I'm at the end of my rope, and I still can't figure out why this has stopped working. I guess I need an expert on iptables configuration.
Here is the iptables code (from iptables-save) with comments.
# Generated by iptables-save v1.3.8 on Thu Jan 5 18:36:25 2012
*nat
# One of the things that I remain ignorant about is what these following three lines
# do in both the nat tables (which we're not using on this machine) and the following
# filter table. I don't know what the numbers are, but I'm ASSUMING they're port
# ranges.
#
:PREROUTING ACCEPT [7435:551429]
:POSTROUTING ACCEPT [6097:354458]
:OUTPUT ACCEPT [5:451]
COMMIT
# Completed on Thu Jan 5 18:36:25 2012
# Generated by iptables-save v1.3.8 on Thu Jan 5 18:36:25 2012
*filter
:INPUT ACCEPT [10423:1046501]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [15184:16948770]
# The following line is for my OpenVPN configuration.
-A INPUT -i tun+ -j ACCEPT
# In researching this on the Internet I found some iptables code that was supposed to
# open the needed ports up. I never needed this before this week, but since passive FTP
# was no longer working, I decided to put the code in. The next three lines are part of
# that code.
-A INPUT -p tcp -m tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --sport 1024:65535 --dport 20 -m state --state ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --sport 1024:65535 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT
# Another line for the OpenVPN configuration. I don't know why the iptables-save mixed
# the lines up.
-A FORWARD -i tun+ -j ACCEPT
# Various forwards for all our services
-A FORWARD -s 65.118.148.197 -p tcp -m tcp --dport 3307 -j ACCEPT
-A FORWARD -d 65.118.148.197 -p tcp -m tcp --dport 3307 -j ACCEPT
-A FORWARD -s 65.118.148.197 -p tcp -m tcp --dport 3306 -j ACCEPT
-A FORWARD -d 65.118.148.197 -p tcp -m tcp --dport 3306 -j ACCEPT
-A FORWARD -s 65.118.148.196 -p tcp -m tcp --dport 21 -j ACCEPT
-A FORWARD -d 65.118.148.196 -p tcp -m tcp --dport 21 -j ACCEPT
-A FORWARD -d 65.118.148.196 -p tcp -m tcp --dport 20 -j ACCEPT
-A FORWARD -s 65.118.148.196 -p tcp -m tcp --dport 20 -j ACCEPT
-A FORWARD -s 65.118.148.196 -p tcp -m tcp --dport 7191 -j ACCEPT
-A FORWARD -d 65.118.148.196 -p tcp -m tcp --dport 7191 -j ACCEPT
-A FORWARD -s 65.118.148.196 -p tcp -m tcp --dport 46000:46999 -j ACCEPT
-A FORWARD -d 65.118.148.196 -p tcp -m tcp --dport 46000:46999 -j ACCEPT
-A FORWARD -s 65.118.148.0/255.255.255.0 -j ACCEPT
-A FORWARD -d 65.118.148.196 -p udp -m udp --dport 53 -j ACCEPT
-A FORWARD -s 65.118.148.196 -p udp -m udp --dport 53 -j ACCEPT
-A FORWARD -d 65.118.148.196 -p tcp -m tcp --dport 53 -j ACCEPT
-A FORWARD -s 65.118.148.196 -p tcp -m tcp --dport 53 -j ACCEPT
-A FORWARD -d 65.118.148.196 -p udp -m udp --dport 25 -j ACCEPT
-A FORWARD -s 65.118.148.196 -p udp -m udp --dport 25 -j ACCEPT
-A FORWARD -d 65.118.148.196 -p tcp -m tcp --dport 42 -j ACCEPT
-A FORWARD -s 65.118.148.196 -p tcp -m tcp --dport 42 -j ACCEPT
-A FORWARD -s 65.118.148.196 -p tcp -m tcp --dport 25 -j ACCEPT
-A FORWARD -d 65.118.148.196 -p tcp -m tcp --dport 25 -j ACCEPT
-A FORWARD -d 65.118.148.196 -p tcp -m tcp --dport 80 -j ACCEPT
-A FORWARD -s 65.118.148.196 -p tcp -m tcp --dport 80 -j ACCEPT
-A FORWARD -d 65.118.148.204 -p tcp -m tcp --dport 80 -j ACCEPT
-A FORWARD -s 65.118.148.204 -p tcp -m tcp --dport 80 -j ACCEPT
-A FORWARD -d 65.118.148.196 -p tcp -m tcp --dport 6667 -j ACCEPT
-A FORWARD -s 65.118.148.196 -p tcp -m tcp --dport 6667 -j ACCEPT
-A FORWARD -s 65.96.214.242 -p tcp -m tcp --dport 22 -j ACCEPT
-A FORWARD -s 192.68.148.66 -p tcp -m tcp --dport 22 -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
# "The line" that causes passive ftp to stop working. Insofar as I can tell, everything
# else seems to work - ssh, telnet, mysql, httpd.
-A FORWARD -j DROP
-A FORWARD -p icmp -j ACCEPT
# The following code is again part of my attempt to put in code that would cause passive
# ftp to work. I don't know why iptables-save scattered it about like this.
-A OUTPUT -p tcp -m tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 20 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 1024:65535 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
COMMIT
# Completed on Thu Jan 5 18:36:25 2012
So, with all that prelude, my basic question is: How can I get passive ftp to work behind an iptables firewall? As you can see, I've tried to get it working (again) and tried to do some research on the issue, but have come up...short.
Any answers would be appreciated by both me and various variable star astronomers around the world! THANKS!
-Richard "Doc" Kinne, American Assoc. of Variable Star Observers, [email protected]
