ftp conntrack with iptables and TLS enabled

[rem]

Hello,

I'm wondering - is it just me, or when client authenticates using TLS
authentication, linux iptables ftp connection tracking does not work
anymore?

I have Gentoo linux up-to-date and pureftpd 1.0.16a with TLS and mysql
support enabled (custom ebuild) and Linux iptables firewall with
ip_conntrack_ftp module enabled. It works like a charm when client
authenticates the usual way, but when TLS is enabled it only works if
firewall is disabled...

any ideas?

--- ACTIVE MODE ---
PROT C
200 OK
PORT 62,85,89,100,7,0
200 PORT command successful
LIST
(timeout)

-- PASSIVE MODE ---
PROT C
200 OK
PASV
227 Entering Passive Mode (62,85,33,154,156,151)
(timeout)

--- compile options ---
--with-altlog \
--with-throttling \
--with-sysquotas --with-ftpwho \
--with-peruserlimits --with-mysql \
--with-tls

--- runtime options ---
-S 21 -c 15 -C 4 -B -k 98% -l mysql:/etc/pureftpd-mysql.conf -I 5 -A -x
-E --tls=1 -p 40000:40100

I'm sorry if this has already been discussed.
best regads,
Kaspars

[Jedi/Sector One]

Post by rem
I'm wondering - is it just me, or when client authenticates using TLS
authentication, linux iptables ftp connection tracking does not work
anymore?

In order to open the right ports, the firewall must inspect commands
exchanged between the client and the server.

The purpose of TLS is to encrypt the commands so that no man-in-the middle
host can snoop the traffic.

The firewall is exactly between the client and the server. The traffic is
encrypted, it can't decrypt it, so it can't know what ports to open.

Fix : install an FTP proxy that uses a fixed port range for passive
connections.

[rem]

Thanks for the quick answer.

Post by Jedi/Sector One

Post by rem
I'm wondering - is it just me, or when client authenticates using TLS
authentication, linux iptables ftp connection tracking does not work
anymore?

In order to open the right ports, the firewall must inspect commands
exchanged between the client and the server.
The purpose of TLS is to encrypt the commands so that no man-in-the middle
host can snoop the traffic.
The firewall is exactly between the client and the server. The traffic is
encrypted, it can't decrypt it, so it can't know what ports to open.
Fix : install an FTP proxy that uses a fixed port range for passive
connections.