0

Server: Ubuntu 15.04 - 2.6.32-042stab094.8

Client: Windows 10

I did some iptables changes, saved all rules, naturally, reapplied them afterwards, summary of changes are:

open ports

  • tcp: 20, 21 ,22 ,43, 443
  • udp: 123

defaults policy

  • input - drop
  • forward - accept
  • output - accept

before changes, default input was accepted thus filezilla connected, etc. after dropping all incoming (except those specified), FZ fails to connect

FZ using SFTP protocol with normal login

am i missing a required port for sftp to connect?

UPDATE

FILTER TABLE

sudo iptables -L -t filter

Chain INPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ftp-data /* FTP-Data IN (iface:ALL) */
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ftp /* FTP-Ctrl IN (iface:ALL) */
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh /* SSH IN (iface:ALL) */
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:whois /* Whois IN (iface:ALL) */
ACCEPT     udp  --  anywhere             anywhere             udp dpt:ntp /* NTP IN (iface:ALL) */
ACCEPT     icmp --  anywhere             anywhere             /* Ping Request/Reply IN (iface:ALL) */

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     icmp --  anywhere             anywhere             /* Ping Request/Reply OUT (iface:ALL) */

Chain LOGGING (0 references)
target     prot opt source               destination

NAT TABLE

sudo iptables -L -t nat


Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
SNAT       all  --  anywhere             anywhere             to:x.x.x.x <- server ip
MASQUERADE  all  --  10.0.0.0/24          anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
Improve this question
3
  • What is the output of sudo iptables -L? Make sure you put the drop policy AFTER all other rules.
    – Stanley Yu
    Oct 20, 2015 at 17:48
  • i flush iptables with accept in all chains, add rules, and thereafter drop all other input packets, i tested it now with my android device using turbo client, it conencts perfectly, on windows I and my colleague have the same issue of filezilla not connecting, filezxilla works when policy is accepted, fz does not work when input is dropped, hence it uses a non-mentioned port, check update for iptables output
    – CybeX
    Oct 20, 2015 at 17:55
  • You're sure you're using SFTP when testing both Filezilla and the Turbo client on Android? FTPS is NOT the same as SFTP.
    – Stanley Yu
    Oct 20, 2015 at 18:17

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .