allowing passive FTP from the outside

[Justin Zygmont]

On Sun, 3 Apr 2005, Robert Slade wrote:

> On Sat, 2005-04-02 at 22:33, Justin Zygmont wrote:
>> On Sat, 2 Apr 2005, Markku Kolkka wrote:
>>
>>> Justin Zygmont kirjoitti viestissään (lähetysaika lauantai, 2.
>>> huhtikuuta 2005 12:23):
>>>> I know the problem is because a nonexistent iptables rule, i'm
>>>> just at a loss as to what the missing rules should look like.
>>>> The only thing that is different in this case is that I need
>>>> to use port 221 for FTP instead of 21,
>>>
>>> That's what breaks everything. The FTP control connection must be
>>> on server port 21. Using a different port violates RFC 959 and
>>> ip_conntrack_ftp doesn't watch any other port for FTP traffic.
>>
>> are you sure ftp_conntrack is even needed?  I thought that's usually used
>> just for stateful routing through a server, and not to connect to one from
>> the outside.  Also when I shut iptables down, it works, I can get a ftp
>> listing.
>>
>> ______________________________________________________________________
> Yes it does. ftp_contrack etc monitors the trafic on port 21 and
> dynamically opens the higher no (data) ports that the control on port 21
> asks for. Turning off iptables just opens all the ports.
>
> If you are using vsftp, then you can set the ports used by passive ftp
> and then open them in iptables, but this is a risk as they can be
> abused. This may be possible with other ftp servers.

then wouldn't this mean that FTP on regular port 21 would not work at all 
unless you had ftp_conntrack loaded?  Because i've ran FTP servers before 
without it, and it worked fine.  Do you happen to remember this option in 
vsftpd?  I don't recall seeing it.

Thanks for the replies everyone..