Hi - I have a ftp server running version 2.0.7 of vsftpd on a CentSO 5.2 server using iptables behind a Linksys router.

The setup works for UNIX machines on either side of the Linksys router.

For the Windows machines it only works if they're behind the Linksys router - ftp does NOT work if they're outside the Linksys router.

I'd like to solve two problems:

(1) make ftp work for Windows clients outside the Linksys router

and then ideally, if possible,

(2) have ftp work for both active and passive connections and restrict those connections to use ports between 40000 to 60000

The ports 20,21 and 40000 to 60000 on the Linksys router are open, and vsftp is configured with the following options

pasv_min_port=40000 pasv_max_port=60000 pasv_address=xxx.xxx.xxx.xxx connect_from_port_20=NO

The ftp entry automatically generated the system in /etc/sysconfig/iptables is

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT

and to IPTABLES_MODULES entry in /etc/sysconfig/iptabes-config I've added

ip_conntrack_ftp

Enclosed are my iptables and vsftp.conf files (which might not make it to the list.)

Regarding item (2), I would guess I would have to add the following entries:

Active: ---------

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 20 --sport 40000:60000 -j ACCEPT -A OUTPUT -p tcp -m tcp --sport 20 --dport 40000:60000 -j ACCEPT

Passive: ---------- -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 40000:60000 --sport 40000:60000 -j ACCEPT -A OUTPUT -p tcp -m tcp --sport 40000:60000 --dport 40000:60000 -j ACCEPT

Adding these entries doesn't noticeably impact the vsftpd, i.e., the connections from the UNIX or Windows behaves identically - I just doubt if they're correct.

Any help would be greatly appreciated!

--- Article. VI. Clause 3 of the constitution of the United States states:

"The Senators and Representatives before mentioned, and the Members of the several State Legislatures, and all executive and judicial Officers, both of the United States and of the several States, shall be bound by Oath or Affirmation, to support this Constitution; but no religious Test shall ever be required as a Qualification to any Office or public Trust under the United States."