Re: [Proftpd-user] iptables and passive ftp over TLS

On 27.08.18 12:54, Kai Schaetzl wrote:
>I have suddenly a firewall issue with passive ftp that didn't happen
>before (I think).

I doubt this did not happen.

>iptables -A SOMEINPUTCHAIN -p tcp -m tcp --dport 20:21 -j ACCEPT
>iptables -A SOMEINPUTCHAIN -p tcp -m conntrack --ctstate
>RELATED,ESTABLISHED --dport 63000:65000 --sport 1024:65535 -j ACCEPT

I don't see reason why you should compare both ports AND the RELATED
connections.

>still works with unencrypted connections. But encrypted connections
>(explicit TLS) time out with directory listing after switching to passive
>ftp. A classic passive ftp firewall problem usually solved with conntrack.
>Now, this stopped to work.
>
>After some experimenting I found that this works:
>iptables -A SOMEINPUTCHAIN -m conntrack --ctstate ESTABLISHED,RELATED -j
>ACCEPT
>iptables -A SOMEINPUTCHAIN -p tcp -m tcp --dport 20:21 -j ACCEPT
>iptables -A SOMEINPUTCHAIN  -p tcp -m state --state NEW --dport
>63000:65000 --sport 1024:65535 -j ACCEPT
>
>It seems that the switch to the encrypted channel is a new connection. But
>it wasn't two weeks ago. I think.

every data connection, even directory listing is a new connection with FTP
protocol.

with encrypted connection (that's what SSL does), the conntrack module can
not know, which port to allow, because it does not see what's in the
connection, and therefore data connections don't match RELATED.

>As this happens only with FTP, although it's a firewall issue, I post the
>question to this list.
>Is the above the correct way to solve this?

the client may issue CCC command prior to sending transfer command, which
removes the encryption, so the conntrack can see which port it's going to be
opened.

other possibility is to simple allow those connections exactly as you did
above.

You can reduce nubmer of passive ports - I doubt you need 2001 ports, unless
you have very busy FTP server.

-- 
Matus UHLAR - fantomas, [email protected] ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
"They say when you play that M$ CD backward you can hear satanic messages."
"That's nothing. If you play it forward it will install Windows."

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html