Re: how to set ports for ip_conntrack_ftp

[Pascal Hambourg <pascal.mail@plouf.fr.eu.org>]

Jonas Meurer a écrit :
>>
>>>>What do the "-d **.**.***.**/31" address ranges represent ?
> 
> the ftp servers listen on both ips. so both are server addresses.
> 
> do you think that i should change the "-d ..." at -A OUTPUT to "-s ..."?

Obviously yes. I just wonder how these rules could accept the control 
connection, as they did not accept the return packets from the server.

[...]
> i would like to support both active and passive mode.

To allow active mode you'll have to perform two actions :

1) Look into your FTP server configuration for an option named "passive 
mode local port range" or the like. You must define a port range that is 
not likely to be used by other local processes (so for example don't 
overlap /proc/sys/net/ipv4/ip_local_port_range). The number of ports in 
the interval must be bigger enough than the expected maximum number of 
simultaneous data connections from FTP clients.

2) Set iptables rules in INPUT and OUTPUT which allow incoming TCP 
connections to the port range you defined in the previous step.

[...]
> user@home~$ lftp user@62.75.128.98:9621
> lftp user@62.75.128.98:/> debug
> 
> lftp user@62.75.128.98:/> set ftp:passive-mode on
> 
> lftp user@62.75.128.98:/> ls
> ---> PASV
> <--- 227 Entering Passive Mode (62,75,128,98,180,236)
> ---- Connecting data socket to (62.75.128.98) port 46316
> `ls' at 0 [Making data connection...]

I guess your ruleset does not allow incoming TCP connections to the port 
46316, so the data connection fails. Don't bother to allow this port, as 
it is dynamic and a different one is chosen by the server for each 
passive data connection.

> lftp user@62.75.128.98:/> set ftp:passive-mode off
> 
> lftp user@62.75.128.98:/> ls
[...]
> ---> PORT 192,168,3,34,197,115
> <--- 200 PORT command successful.
> ---> LIST
> <--- 150 Opening ASCII mode data connection for file list
> <--- 426 Connection closed; transfer aborted
> ---- Closing data socket

That's probably the effect of the -d option in the second OUTPUT rule. 
The server tries to open a data connection to the TCP port 50547 of 
192.168.3.34, but this destination address doesn't match the -d option. 
Try to change -d to -s. Check also that there is no packet filter on the 
client which may block FTP data connections.