iptables and ftp

["Roman Gavrilov" <romio@netvision.net.il>]

[-- Attachment #1: Type: text/plain, Size: 1172 bytes --]

Hello,

My question is about ftp and ftp data connections.
I know this subject has been heavily discussed but still ...

I set up my firewall to allow connections to 21 and 20 ports.
 I also allowed connections to high ports from outside from port 20.
and of course I enabled all established and related connections.


But when ever I connect to my ftp server and issuing "ls" command it stacks.
In the firewall I see :
Feb 22 04:07:46 hostname IN=eth0 OUT= MAC=00:e0:18:d3:1b:4b:00:90:5f:0d:64:38:08:00  SRC=source ip DST=my server ip LEN=60 TOS=00 PREC=0x00 TTL=53 ID=41512 DF PROTO=TCP SPT=37070 DPT=21773 SEQ=3256137382 ACK=0 WINDOW=5648 SYN URGP=0

SPT=37070 DPT=21773 looks strange to me.

It seems that ftp data session is trying to establish connection from a high port to a high port.
SYN means that it trying to establish connection and of course it is dropped by the firewall.
There is no sense in allowing anything from outside to servers high ports.

I think that the client should issue a connect request from a high port to servers 20 port.
And then it should match the established connection.

What can be the problem ?

Thanks


[-- Attachment #2: Type: text/html, Size: 2671 bytes --]