I have tried to Google around to get a iptable for my FTPS with TLS (proftpd) working with the iptables killswitch I now have working (see https://www.reddit.com/r/linuxquestions/comments/57mga5/is_my_iptables_killswitch_working_have_some_p/ ).
I use port 10210 for the FTPS and 60100-60119 for passive ports, this traffic don't go thru the VPN. I have come up with this (they are above the last drop lines):
# Allow traffic via TLS FTPS
iptables -A INPUT -p tcp -m tcp --dport 10210 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
# It seems to be working without the line under
#iptables -A INPUT -p tcp -m tcp --dport 20 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -m tcp --sport 10210:60119 --dport 60100:60119 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -j REJECT --reject-with icmp-port-unreachable
iptables -A OUTPUT -p tcp -m tcp --dport 10210 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
# It seems to be working without the line under
#iptables -A OUTPUT -p tcp -m tcp --dport 20 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --sport 10210:60119 --dport 10210:60119 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
It seems to work, but as I am a iptables noob, I'm wondering what I have done wrong (I probably have ;), not sure about the port ranges and maybe it is to open?)
EDIT I had problems with connections, so I have changed to this that work better
-A INPUT -p tcp -m tcp --dport 10210 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --sport 10210 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 60100:60119 -j ACCEPT
-A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 10210 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 10210 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 60100:60119 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 60100:60119 -j ACCEPT
I will later, after reading http://ipset.netfilter.org/iptables-extensions.man.html , try this instead of the port ranges above
iptables -A INPUT -p tcp --dport 60100:60119 -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 60100:60119 -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 60100:60119 -m conntrack --ctstate NEW,ESTABLISHED,RELATED-j ACCEPT
And remove -A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT and also I wonder if I actually also should remove -m conntrack --ctstate NEW,ESTABLISHED for 10210 as it IS the incoming port for the FTPS?