FTP not working with iptables

Question

FTP

Firewall simple rules
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 21 - j ACCEPT
iptables -A INPUT -i lo -j

ACCEPT , I turn off the fireworks, everything works for everyone, I have no lag.

When passive, people crash like this
Command: LIST
Error: Connection timed out
Error: Failed to retrieve directory listing

When active
Response: 200 Switching to Binary mode.
Command: PORT 192,168,123,104,227,59
Response: 500 Illegal PORT command.
Error: Failed to retrieve directory listing

There are two interfaces on the server eth0 eth1
ON eth0 hangs through aliases 25 ip addresses (eth0:1, eth0:2, eth0:3, etc.)
One private ip hangs on eth1.
Everything goes through eth0.

What could be the problem?

Answer 1

Well, where do you have open FTP in the rules?
You also need to specify passive ports on the daemon itself, and open them on the firewall.
What demon?
> What could be the problem?
In your misunderstanding of what is happening.

Answer 2

You can also download nf_conntrack_ftp

Answer 3

Port 21 is for management. The data goes on the X port(s). You need to find the setting responsible for this in the settings of your ftp server, set these ports there and make a hole in them in the firewall.
Usually, the ftp server, when working in passive mode, randomly assigns a port for data, informs it through the 21st client, then the client uses it, but this request is inhibited by the firewall, so nothing works.

Answer 4

>And if FTP is active?
So it does not matter. When active in the LISTEN state, the socket hangs on the client, on the server it will be in SYN_SENT initially, but it will not reach ESTABLISHED, because the firewall will not allow it to do so.

Answer 5

In general, I highly recommend reading UNIX: Network Application Development by Stevenson. IMHO, an ingenious work that is equally good to use both as a textbook and as a reference.