Score:0

Server

iptables FTP connection tracking not working

Robert Schmitt

1/27/23, 10:25 AM

I am hoping someone can point me in the right direction here please.

Running proftpd (with tls support) on a public IP.

FTP client connects, but can't do a directory listing. When I change the "INPUT" policy on iptables to ACCEPT, it does work.

The following is my relevant iptables rules:

$IPTABLES -A INPUT -i eno1 -s 0/0 -d x.x.x.x -p tcp --sport 1024:65535 -m multiport --dports 20,21,989,990 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A INPUT -p tcp -s 0/0 --sport 1024:65535 -d x.x.x.x --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT

I have the connection_tracking modules enabled.

server ~ # lsmod | grep nf_conntra
nf_conntrack_ftp       24576  3
nf_conntrack          176128  8 xt_conntrack,nf_nat,xt_state,xt_nat,xt_helper,nf_conntrack_ftp,xt_CT,xt_MASQUERADE
nf_defrag_ipv6         24576  1 nf_conntrack
nf_defrag_ipv4         16384  1 nf_conntrack
libcrc32c              16384  2 nf_conntrack,nf_nat

I also have nf_conntrack_helper enabled in /proc

server ~ # cat /proc/sys/net/netfilter/nf_conntrack_helper
1

165

0 + 0

iptables

ftp

conntrack

nf-conntrack

proftpd

Alex

1/27/23, 10:38 AM

Is it working in passive mode? Note that in active mode connections are initiated not on the same socket, but on different port... See https://superuser.com/questions/729876/connection-to-filezilla-ftp-server-works-but-directory-listing-fails and https://www.moreofless.co.uk/ftp-connects-no-directory-listing-command-passive/#:~:text=If%20you%20are%20able%20to,ftp%3E%20passive%20Passive%20mode%20on.

Robert Schmitt

1/27/23, 10:46 AM

It does not work in active or passive mode with TLS, however it does work if I disable encryption.

Score:1

Server

anonymous

1/27/23, 10:55 AM

proftpd (with tls support)

That TLS support is probably the culprit.

Normally in an intelligent firewall when you allow FTP you need to open the port for the control connection, TCP 21 and then, in the clear text FTP protocol, the conntrack modules can scan for and detect the PORT response. An FTP conntrack helper module will then automatically open up the port number that gets assigned by the FTP server to that specific client, as related, allowing for quit granular access control.

When the connection is encrypted with TLS the firewall can't detect the PORT response anymore and therefor not automatically open the assigned port. The solution for that is to :

fix the range of ports the FTP server will use for passive connections to a small range
PassivePorts min-pasv-port max-pasv-port
in your firewall open both port 21 and that fixed range of ports for data connections

0 + 0

Robert Schmitt

1/29/23, 6:03 PM

Thank you, that makes sense. At least I understand what is happening!

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: iptables FTP connection tracking not working

TH: การติดตามการเชื่อมต่อ FTP ของ iptables ไม่ทำงาน

RO: Urmărirea conexiunii FTP iptables nu funcționează

RU: Отслеживание FTP-соединения iptables не работает

VI: iptables Theo dõi kết nối FTP không hoạt động

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.