Arch Linux

calef13

Member

Registered: 2007-06-10

Posts: 142

ftp firewall problem[FIXED]

Hi,

I am trying to set up vsftpd on a home server running arch. Everything works fine but I can only log in with iptables disabled or else the directory listing (list command) fails. I have opened port 20 and 21 and have connect from port 20=YES in vsftpd.conf and I cannot figure out what is wrong.

Below is my iptables -L:

Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere             //<----Allow all local loopback connections
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ftp
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ftp-data
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:http
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:https
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

SSH works fine and I have 'vsftpd:ALL' in my /etc/hosts.allow

Can anyone tell me what I am doing wrong with the firewall? I am pretty new to iptables.

Calef13

Last edited by calef13 (2007-08-15 18:23:35)

hongy19

Member

From: China

Registered: 2005-04-08

Posts: 83

Website

Re: ftp firewall problem[FIXED]

I meet the same question.
when vsftpd is in standalone mode ,and tcp_wrapper suppot.
user can login, but list command  fail.

but if vsftpd  in standalone mode with no tcp_wrapper suppot , everything is OK.

something like this

[md@Arch ~]$ ftp -vd 192.168.1.100
Connected to 192.168.1.100.
220 (vsFTPd 2.0.5)
Name (192.168.1.100:md): anonymous
---> USER anonymous
421 Timeout.
Login failed.
---> SYST
No control connection for command: Success
ftp> quit

Last edited by hongy19 (2007-08-15 14:53:38)

calef13

Member

Registered: 2007-06-10

Posts: 142

Re: ftp firewall problem[FIXED]

Unfortunately, disabling tcp wrappers doesn't fix my problem, so I'm doubly sure it's only the firewall, but my firewall is fine afaik, I followed the guide on the wiki to an extent, simplifying it down. I guess blocking icmp messages isn't a great idea, but they aren't vital and aren't contributing to the problem as far as I can tell, wireshark isn't showing any icmp messages.

Anyone else have any advice to offer?

Calef13

jerem

Member

From: France

Registered: 2005-01-15

Posts: 310

Re: ftp firewall problem[FIXED]

You need the ftp conntrack helper module.

I dont remember the exact name but it may be ip_conntrack_ftp

calef13

Member

Registered: 2007-06-10

Posts: 142

Re: ftp firewall problem[FIXED]

That fixed it, thanks so much this has been bugging me for ages. Where did you find that out? I should look into this more. BTW, I think we should add this to the wiki, what do you think?

Calef13