Enable ftp connection through iptables firewall

Modprobeip_nat_ftpmodprobeip_conntrack_ftpiptables-AINPUT-ptcp -- dport21-jACCEPTiptables-AOUTPUT-mstate -- stateESTABLISHED, RELATED-jACCEPTiptables-AINPUT-mstate --

Modprobe ip_nat_ftp
Modprobe ip_conntrack_ftp
Iptables-A input-p tcp -- dport 21-j ACCEPT
Iptables-a output-m state -- state ESTABLISHED, RELATED-jACCEPT
Iptables-a input-m state -- state ESTABLISHED, RELATED-jACCEPT
Try to retain the last one in the front. if not, add ~ to the last one ~

In addition:

Configure Active and Passive FTP mode using iptables

The FTP protocol can work in two ways: PORT and PASV. the Chinese meaning is active and passive.

Port mode: ftp server: tcp 21 <------ client: dynamic ftp server: tcp20 ------> client: dynamic

Pasv mode: ftp server: tcp 21 <---- client: dynamic ftp server: tcpdynamic <---- client: dynamic
The active connection process is that the client sends a connection request to the ftp port of the server (21 by default). The server accepts the connection and establishes a command link. When data needs to be transmitted, the client uses the PORT command on the command link to tell the server: "I opened PORT XXXX and you came to connect to me ". The server sends a connection request from Port 20 to Port XXXX of the client and establishes a data link to transmit data.
PASV (passive) connection process: the client sends a connection request to the FTP port of the server (21 by default). The server accepts the connection and establishes a command link. When data needs to be transmitted, the server uses the PASV command on the command link to tell the client: "I opened Port XXXX, and you came to connect to me ". Therefore, the client sends a connection request to Port XXXX of the server and establishes a data link to transmit data.

# Allow all ftp incoming connections
Iptables-a input-p tcp -- dport 21-m state -- state ESTABLISHED-jACCEPT
Iptables-a output-p tcp -- sport 21-m state -- stateNEW, ESTABLISHED-j ACCEPT

# Enable active ftp transfers
Iptables-a input-p tcp -- dport 20-m state -- state