I've setted some main ports – 20, 21, 22, 23, 53, 80, 443 for incoming and outgoing TCP connections.
If i want to connect from inside my server to another ftp server, it uses random UDP port in range 30000-60000.
So i decided to make an iptables rule:
iptables -A INPUT -p udp -m multiport --dports 1:65535 -j ACCEPT
Generally, is it safe to leave this rule? Is there any type of attacks to UDP port? Thank you.
Best Answer
FTP is using TCP exclusively. Your ftp server might use UDP to resolve ip addresses. If you are using conntrack for accepting related packets You don't need additional rules for any UPD packets (incoming DNS reply will by accepted by --state RELATED rule in your firewall).
Having said that FTP in passive mode requires establishing a TCP connection to additional port on the server. In most ftp servers You can set, a range used for that. I suggest using some random range higher ports eg. 50000-56000 (mayby outside of local port range defined in sysctl net.ipv4.ip_local_port_range). Some firewalls can snoop on ftp control connections (port 21) and open ports accordingly but You should use encryption for all Your control connections and this defeats those firewall mechanisms.
You could tighten those ports by adding -m owner --uid-owner 0 so only root can accept those connections.
TL;DR
No You don't need UDP for FTP, but You need to define a range of TCP ports if You don't want to accept all incoming TCP connections on ports > 1024.