Facebook
Twitter
C
CiViX
Guest
I've been having problems with ftp lately. Most users can use passive ftp fine. But a few users on a few networks (ISPs) have problems with the connection timing out after a while. They can upload a couple of files (each 1-2 MB), but then it suddenly stops.
As this only affects some users, I first didn't think that the problem was related to our servers. But strangely enough it works fine for all users if I disable the firewall (apf).
I do not want to allow open high ports, and this shouldn't be necessary either if ip_conntrack_ftp is loaded, as far as I understand.
For most users ftp works perfectly if I open only port 21/tcp in. I do not need to open 20/21 out. As ftp is strictly a tcp-protocol no special udp-ports have to be opened (although most users seem to open 21/21 also in udp).
This works for 99% of our customers:
********************************************
IG_TCP_CPORTS="21,22,25,53,80,106,110,113,143,161,162,199,443,465,993,995,8443,3306,5432"
IG_UDP_CPORTS="53,161,162,993,995"
EGF="1"
EG_TCP_CPORTS="22,25,43,53,80,113,443,5224"
EG_UDP_CPORTS="53,123"
********************************************
For the handful of users that have "timeout"-problems, it works if I either disable output-filtering, or if I open 1024_65535/tcp output. But with ip_conntrack_ftp I didn't think this should be necessary.
This works for all users:
*********************************************
IG_TCP_CPORTS="20,21,22,25,53,80,106,110,113,143,161,162,199,443,465,993,995,8443,3306,5432"
IG_UDP_CPORTS="53,161,162,993,995"
EGF="1"
EG_TCP_CPORTS="22,25,43,53,80,113,443,5224,1024_65535"
EG_UDP_CPORTS="53,123"
*********************************************
...or simply EGF="0" (although this is not desirable).
I have also tried this:
EG_TCP_CPORTS="22,25,43,53,80,113,443,5224,35000_40000"
while adding
PassivePorts 35000 40000
to proftpd.conf, but then it doesn't work. I must open the whole range 1024-65535 for it to work...
(Yes I restart xinetd/apf after the changes.)
I understand that apf loads ip_conntrack_ftp automatically, and if I do an lsmod I get this (edited) output:
Module Size Used by
iptable_nat 27229 0
ipv6 240225 38
ipt_TOS 6337 2
iptable_mangle 6721 1
ip_conntrack_ftp 76273 0
ip_conntrack_irc 75505 0
ipt_REJECT 10561 3
ipt_LOG 10049 2
ipt_limit 6337 7
iptable_filter 6721 1
ipt_multiport 5953 4
ipt_state 5825 16
ip_conntrack 45573 4 iptable_nat,ip_conntrack_ftp,ip_conntrack_irc,ipt_state
ip_tables 21441 9 iptable_nat,ipt_TOS,iptable_mangle,ipt_REJECT,ipt_LOG,ipt_limit,iptable_filter,ipt_multiport,ipt_state
Doesn't this mean that ip_conntrack_ftp is loaded? Why is it not doing it's job?
Could anyone please help me solve this strange problem?
As this only affects some users, I first didn't think that the problem was related to our servers. But strangely enough it works fine for all users if I disable the firewall (apf).
I do not want to allow open high ports, and this shouldn't be necessary either if ip_conntrack_ftp is loaded, as far as I understand.
For most users ftp works perfectly if I open only port 21/tcp in. I do not need to open 20/21 out. As ftp is strictly a tcp-protocol no special udp-ports have to be opened (although most users seem to open 21/21 also in udp).
This works for 99% of our customers:
********************************************
IG_TCP_CPORTS="21,22,25,53,80,106,110,113,143,161,162,199,443,465,993,995,8443,3306,5432"
IG_UDP_CPORTS="53,161,162,993,995"
EGF="1"
EG_TCP_CPORTS="22,25,43,53,80,113,443,5224"
EG_UDP_CPORTS="53,123"
********************************************
For the handful of users that have "timeout"-problems, it works if I either disable output-filtering, or if I open 1024_65535/tcp output. But with ip_conntrack_ftp I didn't think this should be necessary.
This works for all users:
*********************************************
IG_TCP_CPORTS="20,21,22,25,53,80,106,110,113,143,161,162,199,443,465,993,995,8443,3306,5432"
IG_UDP_CPORTS="53,161,162,993,995"
EGF="1"
EG_TCP_CPORTS="22,25,43,53,80,113,443,5224,1024_65535"
EG_UDP_CPORTS="53,123"
*********************************************
...or simply EGF="0" (although this is not desirable).
I have also tried this:
EG_TCP_CPORTS="22,25,43,53,80,113,443,5224,35000_40000"
while adding
PassivePorts 35000 40000
to proftpd.conf, but then it doesn't work. I must open the whole range 1024-65535 for it to work...
(Yes I restart xinetd/apf after the changes.)
I understand that apf loads ip_conntrack_ftp automatically, and if I do an lsmod I get this (edited) output:
Module Size Used by
iptable_nat 27229 0
ipv6 240225 38
ipt_TOS 6337 2
iptable_mangle 6721 1
ip_conntrack_ftp 76273 0
ip_conntrack_irc 75505 0
ipt_REJECT 10561 3
ipt_LOG 10049 2
ipt_limit 6337 7
iptable_filter 6721 1
ipt_multiport 5953 4
ipt_state 5825 16
ip_conntrack 45573 4 iptable_nat,ip_conntrack_ftp,ip_conntrack_irc,ipt_state
ip_tables 21441 9 iptable_nat,ipt_TOS,iptable_mangle,ipt_REJECT,ipt_LOG,ipt_limit,iptable_filter,ipt_multiport,ipt_state
Doesn't this mean that ip_conntrack_ftp is loaded? Why is it not doing it's job?
Could anyone please help me solve this strange problem?
