So I managed to get a configuration of iptables that suits my needs, primarily based on 2+ hours of research and reading similar Stack Exchange and forum posts.

However, this seems to have broken my FTP connection, as it used to work fine prior to this. This Pi is a DMZ as my ISP provides routers that prevents forwarding of mail ports (which I need), and getting another router isn't an option, because the current one uses coax input from a splitter that also goes into the TV box. I mean, I could get an AP and just attach it to the box and run the current router in modem mode, but that's a whole another story, and I don't feel like buying one (yet).

This is what I get when trying to connect:

Status: Connecting to
Status: Connection established, waiting for welcome message...
Status: Insecure server, it does not support FTP over TLS.
Status: Server does not support non-ASCII characters.
Status: Logged in
Status: Retrieving directory listing...
Command:    PWD
Response:   257 "/"
Command:    TYPE I
Response:   200 Switching to Binary mode.
Command:    PASV
Response:   227 Entering Passive Mode (192,168,0,14,66,183).
Command:    LIST
Error:  Connection timed out after 20 seconds of inactivity
Error:  Failed to retrieve directory listing

It gets stuck for a while on "Retrieving directory listing...". I'm running Raspbian 4.9.30+ and vsftpd 3.0.2

This is my iptables config:

# Generated by iptables-save v1.4.21 on Tue Jun  6 21:50:00 2017
:INPUT ACCEPT [2544:504150]
:OUTPUT ACCEPT [2356:284029]
-A INPUT -m state --state INVALID -j DROP
-A INPUT -i lo -j ACCEPT

-A INPUT -p tcp --dport 21 -m state --state NEW -s -j ACCEPT
-A INPUT -p tcp --dport 22 -m state --state NEW -s -j ACCEPT
-A INPUT -p tcp --dport 25 -m state --state NEW -s -j ACCEPT
-A INPUT -p tcp --dport 80 -m state --state NEW -s -j ACCEPT
-A INPUT -p tcp --dport 110 -m state --state NEW -s -j ACCEPT
-A INPUT -p tcp --dport 443 -m state --state NEW -s -j ACCEPT

# Completed on Tue Jun  6 21:50:00 2017

So what do?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.