[Proftpd-user] iptables and passive ftp over TLS

I have suddenly a firewall issue with passive ftp that didn't happen 
before (I think). Ubuntu 16.04.

Using:
iptables -A SOMEINPUTCHAIN -p tcp -m tcp --dport 20:21 -j ACCEPT
iptables -A SOMEINPUTCHAIN -p tcp -m conntrack --ctstate 
RELATED,ESTABLISHED --dport 63000:65000 --sport 1024:65535 -j ACCEPT

and PassivePorts 63000 65000

still works with unencrypted connections. But encrypted connections 
(explicit TLS) time out with directory listing after switching to passive 
ftp. A classic passive ftp firewall problem usually solved with conntrack. 
Now, this stopped to work.

After some experimenting I found that this works:
iptables -A SOMEINPUTCHAIN -m conntrack --ctstate ESTABLISHED,RELATED -j 
ACCEPT
iptables -A SOMEINPUTCHAIN -p tcp -m tcp --dport 20:21 -j ACCEPT
iptables -A SOMEINPUTCHAIN  -p tcp -m state --state NEW --dport 
63000:65000 --sport 1024:65535 -j ACCEPT

It seems that the switch to the encrypted channel is a new connection. But 
it wasn't two weeks ago. I think.

As this happens only with FTP, although it's a firewall issue, I post the 
question to this list.
Is the above the correct way to solve this?

Thanks!

Kai



------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html