1

With the following rules inside the nftables input chaing:

tcp dport 21 ct state established,new counter accept
tcp dport 20 ct state established,related counter accept
tcp dport 1024-65535 ct state established,related counter accept

The pasive FTP connections can login but the data connection can't be established.

rfmoz
  • 694
  • 9
  • 15

1 Answers1

1

In recent kernels (>4.7) it's necessary to load the following module:

modprobe nf_conntrack_ftp

And enable the helper:

echo 1 > /proc/sys/net/netfilter/nf_conntrack_helper

rfmoz
  • 694
  • 9
  • 15
  • See also https://home.regit.org/netfilter-en/secure-use-of-helpers/ . Since nft 0.8 a similar usage (with some priority differences) is done: https://manpages.debian.org/testing/nftables/nft.8.en.html#CT – A.B May 10 '18 at 19:13