Ftp – ProFTPD and firewall configuration for PassivePorts

ftpportproftpdubuntu-14.04

I use ProFTPD on my server, and when I try to connect to my server with FileZilla or WinSCP, I have this error :

Command: MLSD
Error:   Connection timed out
Error:   Failed to retrieve directory listing

My firewall configuration is (/etc/init.d/firewall) :

#!/bin/sh

sudo iptables -t filter -F
sudo iptables -t filter -X

sudo iptables -t filter -P INPUT DROP
sudo iptables -t filter -P FORWARD DROP
sudo iptables -t filter -P OUTPUT DROP

sudo iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
sudo iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
sudo iptables -t filter -A INPUT -i lo -j ACCEPT
sudo iptables -t filter -A OUTPUT -o lo -j ACCEPT

# ICMP (Ping)
sudo iptables -t filter -A INPUT -p icmp -j ACCEPT
sudo iptables -t filter -A OUTPUT -p icmp -j ACCEPT

# SSH
sudo iptables -t filter -A INPUT -p tcp --dport 3636 -j ACCEPT
sudo iptables -t filter -A OUTPUT -p tcp --dport 3636 -j ACCEPT
sudo iptables -t filter -A INPUT -p tcp --dport 22 -j ACCEPT
sudo iptables -t filter -A OUTPUT -p tcp --dport 22 -j ACCEPT

# DNS
sudo iptables -t filter -A OUTPUT -p tcp --dport 53 -j ACCEPT
sudo iptables -t filter -A OUTPUT -p udp --dport 53 -j ACCEPT
sudo iptables -t filter -A INPUT -p tcp --dport 53 -j ACCEPT
sudo iptables -t filter -A INPUT -p udp --dport 53 -j ACCEPT

# HTTP
sudo iptables -t filter -A OUTPUT -p tcp --dport 80 -j ACCEPT
sudo iptables -t filter -A INPUT -p tcp --dport 80 -j ACCEPT

# FTP
sudo iptables -t filter -A OUTPUT -p tcp --dport 20:21 -j ACCEPT
sudo iptables -t filter -A INPUT -p tcp --dport 20:21 -j ACCEPT

# Mail SMTP
sudo iptables -t filter -A INPUT -p tcp --dport 25 -j ACCEPT
sudo iptables -t filter -A OUTPUT -p tcp --dport 25 -j ACCEPT

# Mail POP3
sudo iptables -t filter -A INPUT -p tcp --dport 110 -j ACCEPT
sudo iptables -t filter -A OUTPUT -p tcp --dport 110 -j ACCEPT

# Mail IMAP
sudo iptables -t filter -A INPUT -p tcp --dport 143 -j ACCEPT
sudo iptables -t filter -A OUTPUT -p tcp --dport 143 -j ACCEPT

# NTP
sudo iptables -t filter -A OUTPUT -p udp --dport 123 -j ACCEPT

iptables -A FORWARD -p udp -m limit --limit 1/second -j ACCEPT
iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/second -j ACCEPT

iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT

Have you a solution please ? Thanks.

Best Answer

Yout packet filter configuration is a mess. Basically, you should set the OUTPUT chain to pass everything (unless you want to filter outgoing traffic initiated from your host) setting it's policy to PASS, and then filter incoming connections using only the INPUT chain (keepeing in mind that you already added the established rule, allowing what you need. This way your host will be able to communicate with the outer world whatever it decides, and outer world will be able to communicate with the ports you allow in the INPUT. The only exception will be the UDP rules, which you will need to allow the incoming part for.

As about passive/active FTP mode, in order to allow DATA traffic to pass, you should allow in the INPUT chains the PassivePort range from the proftpd.conf (this way the passive ftp will work) and active ftp will work just fine using the OUTPUT pass policy.

Related Topic