Home / server / Questions / 203177
Accepted
Juddling
Asked: 2010-11-18 14:04:15 +0800 CST

ftp tls firewalled :(

  • 772

My FTP(s) isn't working when my firewall is enabled. I have always had my iptables set up for me in the past, I learnt roughly how to set one up yesterday, but I've missed a rule that this requires. Here is my iptables.rules

# Generated by iptables-save v1.4.4 on Tue Nov 16 23:23:50 2010
*filter
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]

-A INPUT -i lo -j ACCEPT
-A INPUT -m state -i eth0 --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 20:21 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 989:990 -j ACCEPT
-A INPUT -p tcp -m tcp -i eth0 --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp -i eth0 --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp -i eth0 --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp -i eth0 --dport 10000 -j ACCEPT
-A INPUT -p icmp -i eth0 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-port-unreachable


COMMIT
# Completed on Tue Nov 16 23:23:50 2010
# Generated by iptables-save v1.4.4 on Tue Nov 16 23:23:50 2010
*mangle
:PREROUTING ACCEPT [95811:65665815]
:INPUT ACCEPT [92355:65212126]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [55795:22371752]
:POSTROUTING ACCEPT [55795:22371752]
COMMIT
# Completed on Tue Nov 16 23:23:50 2010
# Generated by iptables-save v1.4.4 on Tue Nov 16 23:23:50 2010
*nat
:PREROUTING ACCEPT [5132:543438]
:POSTROUTING ACCEPT [953:67517]
:OUTPUT ACCEPT [953:67517]
COMMIT
# Completed on Tue Nov 16 23:23:50 2010

So just to summarize, my FTP will connect but not show any files with the firewall enabled. with firewall disabled, everything is perfect.

EDIT: the only otherway I have got this to work with the firewall is disabling ipv6, disabling TLS and adding a rule to the firewall which allows connection from my home network (server is elsewhere)

firewall ftp iptables tls

3 Answers

  1. Best Answer

    In Passive mode, when the client wants to get a file from the server or send a file to the server, the FTP server will pick a random port and send that port to the FTP client.

    When you're not using encryption, a properly configured firewall (using the ip_conntrack_ftp helper kernel module, which may be what you're missing for non-TLS connections) would "listen in" on the connection and mark these connections as RELATED. With encryption the firewall can't listen in.

    The quick and dirty solution to this is to configure the FTP server to choose a small range of ports for passive connections, and then allow access to all of these ports. For instance, in vsftpd:

    pasv_min_port=12000
pasv_max_port=12049

    Then in iptables:

    iptables -A INPUT -p tcp -m tcp -i eth0 --dport 12000:12049 -j ACCEPT

    Allowing anyone to access these ports opens one possible exploit: if someone were to be scanning them over and over they might get lucky and be able to "beat" the real user to the data port and grab the file. Ideally your FTP server would check and make sure the connection is coming from the same place as the original connection, but thanks to things like "FXP" (transferring files from one server to another server by convincing one to make an active connection to the other's passive data port) some servers don't check the connection by default. You should check your configuration file and see if there is an option to disable FXP, and use it. (vsftpd calls this "promiscuous" and is disabled by default.)

    • 7

  2. I don't have direct experience with FTPS, but it is possible that because the control channel is encrypted, netfilter's connection-tracking code is not able to learn the appropriate port to open to allow a client's incoming data connection (for passive mode). That might explain why "everything is perfect" when the firewall is disabled. If possible, try using active mode. Unfortunately, I suspect that if the client is also behind a firewall, then active mode is likely to be blocked as well, for much the same reason!

    • 1

  3. if the FTP connection starts but no files can be seen/transferred then try using passive mode (just type PASV in a commandline ftp client). Without passive mode the server will try to set up a connection back to your machine on an anonymous port. At least, that's what happens with plain FTP - don't know how it is done with FTPS :S

    HTH,

    JJK

    • 0