firewall - ftp tls firewalled :(

My FTP(s) isn't working when my firewall is enabled. I have always had my iptables set up for me in the past, I learnt roughly how to set one up yesterday, but I've missed a rule that this requires. Here is my iptables.rules

# Generated by iptables-save v1.4.4 on Tue Nov 16 23:23:50 2010
*filter

:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]

-A INPUT -i lo -j ACCEPT
-A INPUT -m state -i eth0 --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 20:21 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 989:990 -j ACCEPT
-A INPUT -p tcp -m tcp -i eth0 --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp -i eth0 --dport 80 -j ACCEPT

-A INPUT -p tcp -m tcp -i eth0 --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp -i eth0 --dport 10000 -j ACCEPT
-A INPUT -p icmp -i eth0 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-port-unreachable


COMMIT
# Completed on Tue Nov 16 23:23:50 2010
# Generated by iptables-save v1.4.4 on Tue Nov 16 23:23:50 2010
*mangle

:PREROUTING ACCEPT [95811:65665815]
:INPUT ACCEPT [92355:65212126]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [55795:22371752]
:POSTROUTING ACCEPT [55795:22371752]
COMMIT
# Completed on Tue Nov 16 23:23:50 2010
# Generated by iptables-save v1.4.4 on Tue Nov 16 23:23:50 2010
*nat
:PREROUTING ACCEPT [5132:543438]

:POSTROUTING ACCEPT [953:67517]
:OUTPUT ACCEPT [953:67517]
COMMIT
# Completed on Tue Nov 16 23:23:50 2010

So just to summarize, my FTP will connect but not show any files with the firewall enabled. with firewall disabled, everything is perfect.

EDIT: the only otherway I have got this to work with the firewall is disabling ipv6, disabling TLS and adding a rule to the firewall which allows connection from my home network (server is elsewhere)

Answer

In Passive mode, when the client wants to get a file from the server or send a file to the server, the FTP server will pick a random port and send that port to the FTP client.

When you're not using encryption, a properly configured firewall (using the ip_conntrack_ftp helper kernel module, which may be what you're missing for non-TLS connections) would "listen in" on the connection and mark these connections as RELATED. With encryption the firewall can't listen in.

The quick and dirty solution to this is to configure the FTP server to choose a small range of ports for passive connections, and then allow access to all of these ports. For instance, in vsftpd:

pasv_min_port=12000
pasv_max_port=12049

Then in iptables:

iptables -A INPUT -p tcp -m tcp -i eth0 --dport 12000:12049 -j ACCEPT

Allowing anyone to access these ports opens one possible exploit: if someone were to be scanning them over and over they might get lucky and be able to "beat" the real user to the data port and grab the file. Ideally your FTP server would check and make sure the connection is coming from the same place as the original connection, but thanks to things like "FXP" (transferring files from one server to another server by convincing one to make an active connection to the other's passive data port) some servers don't check the connection by default. You should check your configuration file and see if there is an option to disable FXP, and use it. (vsftpd calls this "promiscuous" and is disabled by default.)