Home / server / Questions / 880551
In Process
rfmoz
Asked: 2017-10-27 22:36:02 +0800 CST

Nftables issue with ftp firewall and conntrack

  • 772

With the following rules inside the nftables input chaing:

tcp dport 21 ct state established,new counter accept
tcp dport 20 ct state established,related counter accept
tcp dport 1024-65535 ct state established,related counter accept

The pasive FTP connections can login but the data connection can't be established.

ftp

1 Answers

  1. In recent kernels (>4.7) it's necessary to load the following module:

    modprobe nf_conntrack_ftp

    And enable the helper:

    echo 1 > /proc/sys/net/netfilter/nf_conntrack_helper

    • 1