Ftp – Nftables issue with ftp firewall and conntrack

connectionftpnftables

With the following rules inside the nftables input chaing:

tcp dport 21 ct state established,new counter accept
tcp dport 20 ct state established,related counter accept
tcp dport 1024-65535 ct state established,related counter accept

The pasive FTP connections can login but the data connection can't be established.

Best Answer

In recent kernels (>4.7) it's necessary to load the following module:

modprobe nf_conntrack_ftp

And enable the helper:

echo 1 > /proc/sys/net/netfilter/nf_conntrack_helper

Related Solutions

Ftp – Using wget to recursively download whole FTP directories

Try -m for --mirror

wget -m ftp://username:password@ip.of.old.host

Iptables – ftp tls firewalled :(

In Passive mode, when the client wants to get a file from the server or send a file to the server, the FTP server will pick a random port and send that port to the FTP client.

When you're not using encryption, a properly configured firewall (using the ip_conntrack_ftp helper kernel module, which may be what you're missing for non-TLS connections) would "listen in" on the connection and mark these connections as RELATED. With encryption the firewall can't listen in.

The quick and dirty solution to this is to configure the FTP server to choose a small range of ports for passive connections, and then allow access to all of these ports. For instance, in vsftpd:

pasv_min_port=12000
pasv_max_port=12049

Then in iptables:

iptables -A INPUT -p tcp -m tcp -i eth0 --dport 12000:12049 -j ACCEPT

Allowing anyone to access these ports opens one possible exploit: if someone were to be scanning them over and over they might get lucky and be able to "beat" the real user to the data port and grab the file. Ideally your FTP server would check and make sure the connection is coming from the same place as the original connection, but thanks to things like "FXP" (transferring files from one server to another server by convincing one to make an active connection to the other's passive data port) some servers don't check the connection by default. You should check your configuration file and see if there is an option to disable FXP, and use it. (vsftpd calls this "promiscuous" and is disabled by default.)

Best Answer

Related Solutions

Ftp – Using wget to recursively download whole FTP directories

Iptables – ftp tls firewalled :(

Related Topic