Fix it!!!
This was the missing link:
$tbls -t raw -A OUTPUT -p tcp --dport 21 -j CT --helper ftp
Here are my new rules:
-T
# FTP Passive Mode stuff
# raw:
#
# This table is used mainly for configuring exemptions from
# connection tracking in combination with the NOTRACK target.
# It registers at the netfilter hooks with higher priority and
# is thus called before ip_conntrack, or any other IP tables.
# It provides the following built-in chains: PREROUTING (for
# packets arriving via any network interface) OUTPUT (for
# packets generated by local processes)
#
## this is a defunct method as of kernel 6.0.1 to assist with active ftp
connection
# if [ "$(cat /proc/sys/net/netfilter/nf_conntrack_helper)" == "0" ]; then
# echo "echo 1 > /proc/sys/net/netfilter/nf_conntrack_helper"
# echo 1 > /proc/sys/net/netfilter/nf_conntrack_helper
# fi
# https://bbs.archlinux.org/viewtopic.php?id=148345
$tbls -t raw -A OUTPUT -p tcp --dport 21 -j CT --helper ftp
$tbls -A dsl-out -o $eth1 -p tcp -s $eth1_addr --sport $unassgn
--dport ftp -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
$tbls -A dsl-in -i $eth1 -p tcp --sport ftp -d $eth1_addr
--dport $unassgn -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
$tbls -A dsl-for -i $eth1 -p tcp --sport ftp -d $internal_net
--dport $unassgn -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
$tbls -A dsl-out -o $eth1 -p tcp -s $eth1_addr -d $ANY_IP -m
helper --helper ftp -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
$tbls -A dsl-in -i $eth1 -p tcp -s $ANY_IP -d $eth1_addr -m
helper --helper ftp -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
$tbls -A dsl-for -i $eth1 -p tcp -s $ANY_IP -d $internal_net -m
helper --helper ftp -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
$tbls -A dsl-out -o $eth1 -p udp -s $eth1_addr --sport $unassgn
--dport ftp -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
$tbls -A dsl-in -i $eth1 -p udp --sport ftp -d $eth1_addr
--dport $unassgn -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
$tbls -A dsl-for -i $eth1 -p udp --sport ftp -d $internal_net
--dport $unassgn -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
$tbls -A dsl-out -o $eth1 -p udp -s $eth1_addr -d $ANY_IP -m
helper --helper ftp -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
$tbls -A dsl-in -i $eth1 -p udp -s $ANY_IP -d $eth1_addr -m
helper --helper ftp -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
$tbls -A dsl-for -i $eth1 -p udp -s $ANY_IP -d $internal_net -m
helper --helper ftp -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
_______________________________________________
users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
