firewall and ftp

[Ignacio Rodríguez Arrós]

I want to make ftp from one of the pc´s on my net, but as i have configured a firewall in linux, i can´t. In the firewall ports 20 and 21 are open, but i can only set a ftp conection but not get data. With iptables line must i put in the linux firewall to permit active ftp

[Alexander Chuzhoy]

also open 21 and 20 udp ports
you need to have in your list the open ports first and the deny rule should come after it...

[Steven E. Protter]

-A INPUT -i eth0 -p tcp -m tcp -- dport 21 -j okay

-A INPUT -i eth0 -p tcp -m tcp -- dport 20 -j okay

in /etc/sydconfig/iptables

if the firewall is not on eth0 adjust that.

save

service iptables restart

SEP

[Stuart Browne · Accepted solution]

You've not detailed what sort of firewalling you're doing, whether you're NAT/Masquerading your local connections via a single 'net connection etc..

My guess is that you are.

You'll also need to insert a few new modules:

modprobe ip_nat_ftp ip_conntrack_ftp

With those two, all should be happy.

[Manuel Wolfshant]

Actually I think it would be beter to use:

iptables -A INPUT -p tcp --dport 21 -j ACCEPT
iptables -A INPUT -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT

if still no go, include some lines for the OUTPUT chain too:
iptables -A OUTPUT -p tcp --sport 21 -j ACCEPT
iptables -A OUTPUT -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT

this would use stateful filtering and take care of both active and passive FTP.
Of course, these are just raw rules, you might wish to adjust them depending on your setup, to only allow traffic from certain machines, through certain interfaces, and so on.

[Ignacio Rodríguez Arrós]

Thanks to all, the problem was that ip_nat_ftp wasn´t load, the 10 points to Stuart Brown