I've installed debian (on my raspberry, but the question is quite generic):Linux raspberrypi 4.9.28+ #998 Mon May 15 16:50:35 BST 2017 armv6l GNU/LinuxAnd I'm trying to set up a simple anonymous and plaintext (no SSL) FTPserver on it (vsftpd). The TCP port is the regular 21 FTP port, and I'mgoing to allow only passive mode.I would like to have a strict firewall configuration, so I'm allowing inonly ssh and the aforementioned FTP server.For this purpose I'm using the conntrack module to allow only legitinbound connections.  For this reason I loaded with modprobe thenf_conntrack_ftp module:modprobe nf_conntrack_ftpMy iptables configuration:# Generated by iptables-save v1.4.21 on Sat Aug 12 15:50:44 2017*filter:INPUT ACCEPT [0:0]:FORWARD ACCEPT [0:0]:OUTPUT ACCEPT [108:11273]-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT-A INPUT -j DROPCOMMIT# Completed on Sat Aug 12 15:50:44 2017With this configuration I'm not able to get the passive data connection towork properly.I've both set up a tcpdump and added a -A INPUT j LOG rule just before the-A INPUT -j DROP: I can clearly see the inbound packets for the Iptablespassivedata connection to be logged and rejected.Some time ago I did pretty much the same setup on a Centos7 machine, where itworked correctly. Am I missing something important?Thanks for any help :)
Iptables: `nf_conntrack_ftp` not working under debian
debian;iptables;raspberry pi;ftp