2

Sorry if this is a stupid question, but to get outbound active FTP connections through our firewall we need to run the following:

sudo modprobe ip_conntrack_ftp

I learned this trick from http://major.io/2007/07/01/active-ftp-connections-through-iptables/

In that article it says to persist it I should add

IPTABLES_MODULES="ip_conntrack_ftp"

to /etc/sysconfig/iptables-config

But I'm not sure that is right for Ubuntu, should I add ip_conntrack_ftp to the bottom of /etc/modules instead?

Thanks.

3

Yes, you can add ip_conntrack_ftp to /etc/modules. Be attentive, you don't have to enter the modprobe command, just the name of kernel module!

3
  • Thanks. What do you mean? Can you just do sudo ip_conntrack_ftp insead of modprobe? – Luke Cousins Apr 14 '14 at 12:41
  • No, add ip_conntrack_ftp line to /etc/modules. – Frantique Apr 14 '14 at 13:04
  • 1
    Oh, I understand what you mean now. Yes, I was aware of that, but thanks for confirming. – Luke Cousins Apr 14 '14 at 13:25
1

Please note that if you are using a nonstandard / custom ftp port, you can just add ports=<portnumber> to the end of the line.

For a specific example, HylaFax works using FTP protocol and begins connections using port 4559 as the control port, and then opens passive FTP ports who-knows-where. All you have to do with a custom FTP port of 4559 is sudo vi /etc/modules and then add a new line to the end of the file with ip_conntrack_ftp ports=4559.

Reboot and you should be good to go!

If you have more than one ftp service, you could also do ports=21,4559 for instance.

For this to work, you will also need the corresponding IPTABLES rules:

-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A INPUT -p tcp -m tcp --dport 4559 -j ACCEPT

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.