Arch Linux

etakeh32

Member

From: Pridnestrovie

Registered: 2014-03-08

Posts: 66

IPTables blocking VSFTPD passive connections despite conntrack

When I stop iptables, I can ftp. When I turn it on I immediately get 'Connection refused'. I set up according to ArchWiki vsftpd > iptables. What am I missing?

[tkh@server ~]$ cat /etc/iptables/iptables.rules
# Generated by iptables-save v1.4.21 on Sun May 24 12:26:32 2015
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [23:3238]
:TCP - [0:0]
:UDP - [0:0]
:sshguard - [0:0]
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth1 -j ACCEPT
-A INPUT -m conntrack --ctstate INVALID -j DROP
-A INPUT -p icmp -m icmp --icmp-type 8 -m conntrack --ctstate NEW -j ACCEPT
-A INPUT -p udp -m conntrack --ctstate NEW -j UDP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW -j TCP
-A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
-A INPUT -p tcp -j REJECT --reject-with tcp-reset
-A INPUT -p tcp -m tcp --dport 9322 -j sshguard
-A INPUT -m state --state NEW -m tcp -p tcp --dport 9321 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-proto-unreachable
-A TCP -p tcp -m tcp --dport 9322 -j ACCEPT
-A TCP -p tcp -m tcp --dport 80 -j ACCEPT
-A TCP -p tcp -m tcp --dport 443 -j ACCEPT
-A TCP -p tcp -m tcp --dport 993 -j ACCEPT
-A TCP -p tcp -m tcp --dport 587 -j ACCEPT
-A TCP -p tcp -m tcp --dport 25 -j ACCEPT
COMMIT
# Completed on Sun May 24 12:26:32 2015

[tkh@server ~]$ cat /etc/modules-load.d/ip_conntrack_ftp.conf
ip_conntrack_ftp
options nf_conntrack_ftp ports=9321
options ip_conntrack_ftp ports=9321

[tkh@server ~]$ cat /etc/vsftpd.conf | egrep -v "(^#.*|^$)"
anonymous_enable=NO
local_enable=YES
write_enable=YES
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
chroot_local_user=YES
chroot_list_enable=NO
listen=YES
userlist_deny=NO
userlist_enable=YES
userlist_file=/etc/vsftpd.allowed_users
seccomp_sandbox=NO
listen_port=9321
[tkh@server ~]$

EDIT: Using tcpdump I found that client is trying to open a new connection to a port in the 30.000 range. I ended up working around this by specifying passive ports in vsftpd.conf and opening that range in iptables. Wish there was a better solution.

Last edited by etakeh32 (2015-05-25 05:23:32)

fukawi2

Ex-Administratorino

From: .vic.au

Registered: 2007-09-28

Posts: 6,231

Website

Re: IPTables blocking VSFTPD passive connections despite conntrack

Did you reboot or manually load the nf_conntrack_ftp kernel module?

---

Are you familiar with our Forum Rules, and How To Ask Questions The Smart Way?

BlueHackers // fscanary // resticctl