When I flush my IPTABLE rules (iptables --flush) vsftpd work is fine.
But not work with my IPTABLE rules/
Ubumtu 16.10.1 x64
All IPTABLE Rules
xxx.xxx.xxx.xxx - its my IP adress
enp2s0 - my Ethernet card
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:lim1 - [0:0]
-A INPUT -p tcp -m tcp --dport 47050 --tcp-flags FIN,SYN,RST,ACK SYN -m connlimit --connlimit-above 20 --connlimit-mask 32 --connlimit-saddr -j DROP
-A INPUT -p tcp -m tcp --dport 48050 --tcp-flags FIN,SYN,RST,ACK SYN -m connlimit --connlimit-above 20 --connlimit-mask 32 --connlimit-saddr -j DROP
-A INPUT -s ххх.хxx.ххх.ххх/32 -j ACCEPT
-A INPUT -i enp2s0 -p tcp -m tcp --dport 47050 -j ACCEPT
-A INPUT -i enp2s0 -p tcp -m tcp --dport 48050 -j ACCEPT
-A INPUT -i enp2s0 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -i enp2s0 -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -d 127.0.0.1/32 -p tcp -m tcp --dport 3306 -j ACCEPT
-A INPUT -s 127.0.0.1/32 -p tcp -m tcp --dport 3306 -j ACCEPT
-A INPUT -d 127.0.0.1/32 -p tcp -m tcp --dport 47050 -j ACCEPT
-A INPUT -s 127.0.0.1/32 -p tcp -m tcp --dport 47050 -j ACCEPT
-A INPUT -d 127.0.0.1/32 -p tcp -m tcp --dport 48050 -j ACCEPT
-A INPUT -s 127.0.0.1/32 -p tcp -m tcp --dport 48050 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 47050 -m recent --update --seconds 2 --name DEFAULT --mask 255.255.255.255 --rsource -j DROP
-A INPUT -p tcp -m state --state NEW -m tcp --dport 47050 -m recent --set --name DEFAULT --mask 255.255.255.255 --rsource -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 48050 -m recent --update --seconds 2 --name DEFAULT --mask 255.255.255.255 --rsource -j DROP
-A INPUT -p tcp -m state --state NEW -m tcp --dport 48050 -m recent --set --name DEFAULT --mask 255.255.255.255 --rsource -j ACCEPT
-A INPUT -i enp2s0 -p icmp -m icmp --icmp-type 0 -j ACCEPT
-A INPUT -i enp2s0 -p icmp -m icmp --icmp-type 3 -j ACCEPT
-A INPUT -i enp2s0 -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A INPUT -i enp2s0 -p icmp -j DROP
-A INPUT -i enp2s0 -p tcp -m tcp --tcp-flags FIN,SYN,ACK SYN -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -o enp2s0 -p tcp -j DROP
-A OUTPUT -o enp2s0 -p tcp -m tcp --dport 47050 -j lim1
-A OUTPUT -o enp2s0 -p tcp -m tcp --dport 48050 -j lim1
-A OUTPUT -o enp2s0 -p tcp -m tcp --dport 47050 -j ACCEPT
-A OUTPUT -o enp2s0 -p tcp -m tcp --dport 48050 -j ACCEPT
-A OUTPUT -o enp2s0 -p icmp -j ACCEPT
-A lim1 -m limit --limit 50/sec -j RETURN
-A lim1 -j DROP
COMMIT
*raw
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
*security
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT
*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
I tried to add different rules, but all no results.
Vsftpd configs.
listen=YES
listen_ipv6=NO
anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
dirmessage_enable=YES
use_localtime=YES
xferlog_enable=YES
connect_from_port_20=YES
chroot_local_user=YES
allow_writeable_chroot=YES
pasv_enable=YES
pasv_max_port=40050
pasv_min_port=40000
secure_chroot_dir=/var/run/vsftpd/empty
pam_service_name=vsftpd
rsa_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
rsa_private_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
ssl_enable=NO
Please help in the adjustment of my rules, since I do not have the competence Thank in advance.