[CentOS] Vsftpd vs. iptables firewall script

[Nels Lindquist]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 2018/05/23 8:24 AM, Nicolas Kovacs wrote:

> I'm currently setting up a local FTP server, to receive disk images
> sent with G4L (Ghost4Linux).
> 
> This server has been running Slackware Linux before, and the
> Vsftpd setup was relatively simple.
> 
> With CentOS things seem to be slightly different, so I'm currently 
> trying to work things out. For the moment, two things seem to be 
> creating problems, the simple iptables firewall and SELinux.
> 
> When I disable the firewall and SELinux, Vsftp works as expected.
> So far so good.
> 
> Now let's tackle this one dragon at a time. First the firewall.
> I'm starting with a very simple firewall script that looks somewhat
> like this. I'm linking to the template, I won't copy/paste the
> whole thing here.
> 
> https://github.com/kikinovak/centos-7-server-lan/blob/master/config/fi
rewall/firewall-standalone.sh
>
>  Under Slackware, the iptables rule for a local FTP server looked
> like this:
> 
> modprobe ip_conntrack iptables -A INPUT -p tcp -i $IFACE_LAN
> --dport 21 -j ACCEPT
> 
> I tried this, but to no avail. Can't connect to my server. I
> googled a bit, and I found out that there seem to be quite many
> different answers about the subject of "how do I configure my
> firewall for Vsftpd".

The ip_conntrack module is necessary, but not sufficient for dynamic
FTP connection tracking.

If you instead load ip_conntrack_ftp, it will auto-load ip_conntrack.
 (On a C7 server the modules are actually nf_conntrack_ftp and
nf_conntrack, but the ip_* names are aliases for them so either will
work.)

Oh, and to make the module configuration permanent, you can use either
the CentOS config file at /etc/sysconfig/iptables-config file (look
for the IPTABLES_MODULES line with associated comments) or on a
systemd box you have the option of /etc/modules-load.d/ (man
modules-load.d for details).

- ----
Nels Lindquist <nlindq at maei.ca>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iEYEARECAAYFAlsIbDgACgkQh6z5POoOLgQh7wCcDcWGpYBqQfmY5OwkJs5LyJI0
zFYAoKY8CnphwueYraMKtU/n1L5xHpp7
=5sU3
-----END PGP SIGNATURE-----