Home / server / Questions / 823409
In Process
S19N
Asked: 2016-12-31 06:30:07 +0800 CST

ip_conntrack_ftp inside LXC

  • 772
  • ProFTPd instance on a LXC container behind NAT
  • LXC container is using bridged networking
  • PassivePorts 60000 61000 has been defined in proftpd.conf
  • nf_nat_ftp and nf_conntrack_ftp loaded on the host running the container

  • iptables inside the container contains

    -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p tcp --dport 21 -m conntrack --ctstate NEW -j ACCEPT

Why does Passive mode only work when I explicitly open passive ports with

-A INPUT -p tcp -m tcp --dport 60000:61000 -j ACCEPT

? Shouldn't this be automatically managed by the nf_conntrack_ftp helper module?

ftp nat iptables proftpd lxc

1 Answers

  1. I experienced the problem that after installing lxc together with a new version of the linux kernel needed, the connection tracker helpers stopped working. This, however, was not a problem of lxc but a problem of the kernel and I could get around it by adding 

    net.netfilter.nf_conntrack_helper=1

    to sysctl.conf. Apparently newer kernels after 4.7 have better ways to configure the helpers (and probably using them would be a better answer to this question) and therefore net.netfilter.nf_conntrack_helper=0 is the default now, see here.

    • 2