Comments on: FTP behind NAT with TLS howto

By: Radek

Radek — Sun, 24 Jan 2010 12:58:44 +0000

The X:Y notation is perfectly valid, at least with iptables v. 1.4.6.

warden:~# iptables -D INPUT -p tcp –destination-port 50000:51000 -m state –state NEW -j ACCEPT

Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp — * * 0.0.0.0/0 0.0.0.0/0 tcp dpts:50000:51000 state NEW

By: AAAle

AAAle — Thu, 02 Apr 2009 20:49:01 +0000

Thanks a lot for this post.
It really solved my problem!!!

By: Radek

Radek — Tue, 10 Feb 2009 16:14:44 +0000

Hi John,

Nope, it is perfectly valid. You mix port specified by commas with a portrange specified with x:y notation.
man iptables
look for port range.

By: John Lee

John Lee — Tue, 10 Feb 2009 15:59:44 +0000

I got an error when using 50000:51000 – I don’t think : is valid here and according to the iptables man page only 15 ports can be specified with multiport. Also I had to add — to your second state option.

Here’s the rule I ended up using

# Allow ftp passive port connections inbound (as I’m using SSL now for FTP Control sessions ip_conntrack_ftp can’t see anything)
iptables -A INPUT -p tcp -i eth0 -m state –state NEW -j ACCEPT -m multiport –dports 51000,51001,51002,51003,51004,51005

I put these entries in my vsftpd.conf
pasv_min_port=51000
pasv_max_port=51005

Thanks for the info – it helped.