documentation_complete: true

title: 'Configure Firewalls to Protect the FTP Server'

description: |-
    By default, <tt>iptables</tt>
    blocks access to the ports used by the web server.
    <iptables-desc-macro allow="true" port="21" proto="tcp" />
    Edit the file <tt>/etc/sysconfig/iptables-config</tt>. Ensure that the space-separated list of modules contains
    the FTP connection tracking module:
    <pre>IPTABLES_MODULES="ip_conntrack_ftp"</pre>

rationale: |-
    These settings configure iptables to allow connections to an FTP server. The first line allows initial connections
    to the FTP server port.
    FTP is an older protocol which is not very compatible with firewalls. During the initial FTP dialogue, the client
    and server negotiate an arbitrary port to be used for data transfer. The <tt>ip_conntrack_ftp</tt>  module is used by
    iptables to listen to that dialogue and allow connections to the data ports which FTP negotiates. This allows an
    FTP server to operate on a system which is running a firewall.

severity: unknown
