So I managed to get a configuration of iptables that suits my needs, primarily based on 2+ hours of research and reading similar Stack Exchange and forum posts.
However, this seems to have broken my FTP connection, as it used to work fine prior to this. This Pi is a DMZ as my ISP provides routers that prevents forwarding of mail ports (which I need), and getting another router isn't an option, because the current one uses coax input from a splitter that also goes into the TV box. I mean, I could get an AP and just attach it to the box and run the current router in modem mode, but that's a whole another story, and I don't feel like buying one (yet).
This is what I get when trying to connect:
Status: Connecting to 192.168.0.14:21... Status: Connection established, waiting for welcome message... Status: Insecure server, it does not support FTP over TLS. Status: Server does not support non-ASCII characters. Status: Logged in Status: Retrieving directory listing... Command: PWD Response: 257 "/" Command: TYPE I Response: 200 Switching to Binary mode. Command: PASV Response: 227 Entering Passive Mode (192,168,0,14,66,183). Command: LIST Error: Connection timed out after 20 seconds of inactivity Error: Failed to retrieve directory listing
It gets stuck for a while on "Retrieving directory listing...". I'm running Raspbian 4.9.30+ and vsftpd 3.0.2
This is my iptables config:
# Generated by iptables-save v1.4.21 on Tue Jun 6 21:50:00 2017 *filter :INPUT ACCEPT [2544:504150] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [2356:284029] -P FORWARD DROP -A INPUT -m state --state INVALID -j DROP -A INPUT -i lo -j ACCEPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -A INPUT -p tcp --dport 21 -m state --state NEW -s 192.168.0.1/24 -j ACCEPT -A INPUT -p tcp --dport 22 -m state --state NEW -s 192.168.0.1/24 -j ACCEPT -A INPUT -p tcp --dport 25 -m state --state NEW -s 0.0.0.0/0 -j ACCEPT -A INPUT -p tcp --dport 80 -m state --state NEW -s 0.0.0.0/0 -j ACCEPT -A INPUT -p tcp --dport 110 -m state --state NEW -s 0.0.0.0/0 -j ACCEPT -A INPUT -p tcp --dport 443 -m state --state NEW -s 0.0.0.0/0 -j ACCEPT -P INPUT DROP COMMIT # Completed on Tue Jun 6 21:50:00 2017
So what do?