Iptables nf_conntrack_ftp not working

ftpiptablespassive

I've done quite a lot of research on iptables with passive FTP, but all boil down to using nf_conntrack_ftp and allowing related/established connections through.

But somehow this ain't working on my server…

The strange thing however:

# cat /proc/net/ip_tables_matches
conntrack
conntrack
conntrack
multiport
udplite
udp
tcp
icmp

# modprobe nf_conntrack_ftp

# echo $?
0

# cat /proc/net/ip_tables_matches
conntrack
conntrack
conntrack
multiport
udplite
udp
tcp
icmp

==> So no conntrack-ftp module loaded? Is that correct?

Then I added these rules to iptables:

-A INPUT -p tcp --dport 21 -m state --state ESTABLISHED,NEW -j ACCEPT [was there already anyhow]
-A INPUT -p tcp --dport 20 -m state --state ESTABLISHED -j ACCEPT
-A INPUT -p tcp --dport 1024: -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

This is what I see at the client side:

[10:47:59] [R] 227 Entering Passive Mode (88,198,90,5,131,43).
[10:47:59] [R] Opening data connection IP: 88.198.90.5 PORT: 33579
[10:48:20] [R] Data Socket Error: Connection timed out
[10:48:21] [R] List Error
[10:48:21] [R] PASV mode failed, trying PORT mode.
[10:48:21] [R] Listening on PORT: 52317, Waiting for connection.
[10:48:21] [R] PORT 192,168,178,50,204,93
[10:48:21] [R] 200 PORT command successful. Consider using PASV.

So PASV doesn't work (it times out and reverts to PORT).

"iptables -m conntrack –help" gives me information, but nf_conntrack_ftp, nf_conntrack, conntrack_ftp all give me:

iptables v1.6.0: Couldn't load match `...':No such file or directory

INPUT policy is DROP, OUTPUT is ACCEPT…

# ls -1 /lib/modules/`uname -r`/kernel/net/netfilter/
ipset
ipvs
nf_conntrack_amanda.ko
nf_conntrack_broadcast.ko
nf_conntrack_ftp.ko
nf_conntrack_h323.ko
nf_conntrack_irc.ko
nf_conntrack.ko
nf_conntrack_netbios_ns.ko
nf_conntrack_netlink.ko
nf_conntrack_pptp.ko
nf_conntrack_proto_dccp.ko
nf_conntrack_proto_gre.ko
nf_conntrack_proto_sctp.ko
nf_conntrack_proto_udplite.ko
nf_conntrack_sane.ko
nf_conntrack_sip.ko
nf_conntrack_snmp.ko
nf_conntrack_tftp.ko
nf_dup_netdev.ko
nf_log_common.ko
nf_nat_amanda.ko
nf_nat_ftp.ko
nf_nat_irc.ko
nf_nat.ko
nf_nat_proto_dccp.ko
nf_nat_proto_sctp.ko
nf_nat_proto_udplite.ko
nf_nat_redirect.ko
nf_nat_sip.ko
nf_nat_tftp.ko
nfnetlink_acct.ko
nfnetlink_cthelper.ko
nfnetlink_cttimeout.ko
nfnetlink.ko
nfnetlink_log.ko
nfnetlink_queue.ko
nf_synproxy_core.ko
nf_tables_inet.ko
nf_tables.ko
nf_tables_netdev.ko
nft_compat.ko
nft_counter.ko
nft_ct.ko
nft_dup_netdev.ko
nft_exthdr.ko
nft_fwd_netdev.ko
nft_hash.ko
nft_limit.ko
nft_log.ko
nft_masq.ko
nft_meta.ko
nft_nat.ko
nft_numgen.ko
nft_queue.ko
nft_quota.ko
nft_redir.ko
nft_reject_inet.ko
nft_reject.ko
nft_set_hash.ko
nft_set_rbtree.ko
x_tables.ko
xt_addrtype.ko
xt_AUDIT.ko
xt_bpf.ko
xt_cgroup.ko
xt_CHECKSUM.ko
xt_CLASSIFY.ko
xt_cluster.ko
xt_comment.ko
xt_connbytes.ko
xt_connlabel.ko
xt_connlimit.ko
xt_connmark.ko
xt_CONNSECMARK.ko
xt_conntrack.ko
xt_cpu.ko
xt_CT.ko
xt_dccp.ko
xt_devgroup.ko
xt_dscp.ko
xt_DSCP.ko
xt_ecn.ko

I hope someone could point out what I'm doing wrong here…

Thanks a lot!

Edit: my current settings:

# Generated by iptables-save v1.6.0 on Sat Dec  9 18:25:25 2017
*raw
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT
# Completed on Sat Dec  9 18:25:25 2017
# Generated by iptables-save v1.6.0 on Sat Dec  9 18:25:25 2017
*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -s 127.0.0.1/32 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p udp -m udp --sport 53 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p udp -m udp --dport 123 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 110 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 20 -m state --state ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
COMMIT
# Completed on Sat Dec  9 18:25:25 2017

Best Answer

I think at some point the nf_conntrack_* modules were changed so that you'll now have to explicitly specify the port numbers of the special protocols.

For FTP, I have this module option line in my /etc/modprobe.d/iptables.conf file:

options nf_conntrack_ftp ports=21

It tells the nf_conntrack_ftp module to expect FTP control traffic specifically in port 21. It used to be the default, but I think the defaults were removed in favor of explicit configuration, back in year 2012 or so.

In kernel version 3.5, it became possible to disable automatic conntrack helper assignment, and it looks like the current practice is to have it disabled by default.

Please see: https://home.regit.org/netfilter-en/secure-use-of-helpers/

According to this, it might even be necessary (or at least preferable) to explicitly invoke the appropriate conntrack helper in the iptables FORWARD rules. That way, you can specify the exact cases when the helper is supposed to be used, and so minimize the risk of spoofing.

Related Topic