Consentire l'FTP attivo e passivo con iptables

FTP Server

Nel caso si hosti un server FTP in una Lan e lo si voglia rendere accessibile tramite nat:

• Caricare il modulo IMPORTANTE

modprobe ip_nat_ftp

• Fare i port mapping necessari

• Aprire le porte come indicato dal documento Active FTP vs. Passive FTP, a Definitive Explanation

FTP Client

Per consentire l'FTP client attivo e passivo da una Lan,

• Caricare il modulo

modprobe ip_conntrack_ftp

• Inserire le seguenti regole:

        # ------------------------------------------------------------------
        # FTP client (21 20 + passive)
        # ------------------

        # Allow ftp outbound.
        $IPTABLES -A FORWARD \
                 -p tcp \
                 -i $LAN0_IF -s $LAN0_NET --sport $UNPRIVPORTS \
                 -o $WAN0_IF --dport 21 \
                 -m state --state NEW,ESTABLISHED -j ACCEPT

        # 1) Active ftp.
        $IPTABLES -A FORWARD  \
                  -p tcp \
                  -i $WAN0_IF --sport 20 \
                  -m state --state ESTABLISHED,RELATED -j ACCEPT

        $IPTABLES -A FORWARD \
                  -p tcp \
                  -o $WAN0_IF --dport 20 \
                  -m state --state ESTABLISHED -j ACCEPT

        # 2) Passive ftp.
        $IPTABLES -A FORWARD  \
                  -p tcp \
                  -i $WAN0_IF --sport $UNPRIVPORTS \
                  --dport $UNPRIVPORTS \
                  -m state --state ESTABLISHED -j ACCEPT

        $IPTABLES -A FORWARD \
                  -p tcp \
                  -i $LAN0_IF --sport $UNPRIVPORTS \
                  -o $WAN0_IF --dport $UNPRIVPORTS \
                  -m state --state ESTABLISHED,RELATED -j ACCEPT

Riferimenti

• DNATing ftp server with iptables - LinuxQuestions.org
• Active FTP vs. Passive FTP, a Definitive Explanation
• James Stephens » Iptables - Example Firewall Rulesets