linux ftp iptables,linux – 使用IPTables允许FTP

我当前的场景涉及允许各种规则,但我需要从任何地方访问ftp.操作系统是Cent 5,我正在使用VSFTPD.我似乎无法使语法正确.所有其他规则都正常工作.

## Filter all previous rules

*filter

## Loopback address

-A INPUT -i lo -j ACCEPT

## Established inbound rule

-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

## Management ports

-A INPUT -s x.x.x.x/24 -p icmp -m icmp --icmp-type any -j ACCEPT

-A INPUT -s x.x.x.x/23 -p icmp -m icmp --icmp-type any -j ACCEPT

-A INPUT -s x.x.x.x/24 -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT

-A INPUT -s x.x.x.x/23 -p icmp -m icmp --icmp-type any -j ACCEPT

-A INPUT -s x.x.x.x/23 -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT

-A INPUT -i lo -j ACCEPT

## Allow NRPE port (Nagios)

-A INPUT -s x.x.x.x -p tcp -m state --state NEW -m tcp --dport 5666 -j ACCEPT

-A INPUT -s x.x.x.x -p tcp -m state --state NEW -m tcp --dport 5666 -j ACCEPT

##Allow FTP

## Default rules

:INPUT DROP [0:0]

:FORWARD DROP

:OUTPUT ACCEPT [0:0]

COMMIT

以下是我尝试过的规则.

##Allow FTP

-A INPUT --dport 21 any -j ACCEPT

-A INPUT --dport 20 any -j ACCEPT

-A INPUT -p tcp --dport 21 -j ACCEPT

-A INPUT -p tcp --dport 20 -j ACCEPT

-A INPUT -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT

-A INPUT -p tcp -m state --state NEW -m tcp --dport 20 -j ACCEPT

-A INPUT -p tcp -s 0/0 -d 0/0 --destination-port 20 -j ACCEPT

-A INPUT -p tcp -s 0/0 -d 0/0 --destination-port 21 -j ACCEPT

-A INPUT -s 0.0.0.0/0 -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT

-A INPUT -s 0.0.0.0/0 -p tcp -m state --state NEW -m tcp --dport 20 -j ACCEPT