Set up a secure vsftpd server in Linux iptables

In practice, you can use the following script to set up a secure internal FTP server. Of course, you can also use Wireshark to understand the passive and active differences between vsftpd. Take the local machine 192.168.0.18 as an example. The script is as follows:

#! /Bin/bash
Iptables-F
Iptables-X
Iptables-Z
Iptables-t nat-F
Iptables-t nat-X
Iptables-t nat-Z


# Enable ip Forwarding
Echo "1">/proc/sys/net/ipv4/ip_forward
# Some module functions required for loading ftp
Modprobe ip_conntrack_ftp
Modprobe ip_conntrack-tftp
Modprobe ip_nat_ftp
Modprobe ip_nat_tftp
# To be safer, define the default OUTPUT policy as DROP
Iptables-P INPUT DROP
Iptables-P OUTPUT DROP
Iptables-P FORWARD ACCEPT
# Open the lo loopback port of the local machine. It is recommended that you open the loopback port. Otherwise, some inexplicable problems may occur.
Iptables-a input-I lo-j ACCEPT
Iptables-a output-o lo-j ACCEPT
# The following script sets up a secure vsftpd key. The last two scripts allow the server to send a response to the client and connect to the data packet that has been established. Because the Passive FTP is complicated, there are six handshakes, so the status is used here.
Iptables-a input-s 192.168.0.0/24-p tcp-dport 21-j ACCEPT
Iptables-a output-d 192.168.0.0/24-p tcp-sport 21-j ACCEPT
Iptables-a input-m state-state RELATED, ESTABLISHED-j ACCEPT
Iptables-a output-m state-state RELATED, ESTABLISHED-j ACCEPT