Active and passive ports used by ftp to upload to remote server

[GanymedRN]

Tried to find it in the forum but without success.
I ran into problems uploading the actual image to my remote server when enabling the ufw firewall.
Everything works fine when the firewall is disabled but I want to increase the safety level of my remote server.

I did allow the active ports 20 and 21 for ftp but it is still not working.
I doubt there is a problem with the passive ports that are used.
What are the ranges I need to allow for those?

[Alex-developer]

Since past ports vary by server you will first need to find out the range used by your ftp server then do something like

sudo ufw allow 21/tcp 
sudo ufw allow 30000:30100/tcp 

If you know which ftp server software is being used I can try and find the defaults for you

[GanymedRN]

Thanks for your reply.

I want the allsky SW running on the Raspi to send files over to my remote server.
The remote server uses Ubuntu 24.04.3 LTS and I did not change the ftp SW that was included in the package.

I ran following two commands to get details on what is happening on port 21

The output of "sudo lsof -i :21" gives:
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
xinetd 920 root 5u IPv6 13300 0t0 TCP *:ftp (LISTEN)

The output of "sudo netstat -tanp" gives:
tcp6 0 0 :::21 :::* LISTEN 920/xinetd

[aaronwmorris]

Your remote server needs to have the ip_conntrack_ftp connection tracking helper module loaded to properly support passive FTP. The connection tracking module will dynamically open the FTP data port in the firewall by monitoring the FTP traffic.

[GanymedRN]

Thanks for the reply.
I will give it a try tomorrow.

[GanymedRN]

I tried the following sequence using nf_conntrack_ftp as it was recommended over ip_conntrack_ftp for newer Linux versions:
sudo -s
modprobe nf_conntrack_ftp
iptables -A INPUT -p tcp --dport 21 -j ACCEPT
ufw enable
Command may disrupt existing ssh connections. Proceed with operation (y|n)? y
Firewall is active and enabled on system startup
Unfortunately ftp transfers from the allsky camera are still not working.

[aaronwmorris]

You should be able to use ufw allow ftp to enable the FTP rule persistently with UFW. (Don't forget ufw allow ssh)

It appears that the FTP connection tracking helper may be disabled by default even with the module loaded (due to security reasons).

You may be able to do something like this:

echo 1 > /proc/sys/net/netfilter/nf_conntrack_helper

... and it could be more complicated than that.

https://home.regit.org/netfilter-en/secure-use-of-helpers/

[GanymedRN]

Thanks for your hints. Sure SSH was allowed before I enabled ufw :-)
Didn't help either. I guess I will not use ufw for now