服務(wù)器用的是pureftp啟用被動(dòng)模式 ，我加了iptables防火墻，F(xiàn)TP就無(wú)法訪問

zhy1899

問題：我把FTP服務(wù)器改為被動(dòng)模式，默認(rèn)端口是30000-50000，以下是我的iptables記錄，一但啟用，F(xiàn)TP就無(wú)法訪問了，看看能否找出問題


sshdport=22
#get DNS
if [ -s /etc/resolv.conf ];then
nameserver1=`cat /etc/resolv.conf |grep nameserver |awk 'NR==1{print $2 }'`
nameserver2=`cat /etc/resolv.conf |grep nameserver |awk 'NR==2{print $2 }'`
fi
IPT="/sbin/iptables"
#  initialise
$IPT -F
$IPT -P INPUT DROP
$IPT -P FORWARD DROP
#$IPT -P OUTPUT DROP
$IPT -A INPUT -i lo -p all -j ACCEPT
$IPT -A OUTPUT -o lo -p all -j ACCEPT
$IPT -N BlockIP
$IPT -I INPUT -j BlockIP
$IPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPT -F
#$IPT -A  INPUT -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -j DROP
#$IPT -A  INPUT -f -j DROP
#$IPT -A  INPUT  -m state --state INVALID -j DROP
#$IPT -A  INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP
#$IPT -A  INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
#$IPT -A  INPUT -i lo -j ACCEPT
$IPT -A  INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
#$IPT -A  INPUT -p udp -m udp --dport 631 -j ACCEPT
$IPT -A  INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPT -A  INPUT -p tcp -m state --state NEW -m tcp --dport 110 -j ACCEPT
$IPT -A  INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
$IPT -A  INPUT -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT
$IPT -A  INPUT -j REJECT --reject-with icmp-host-prohibited
$IPT -A  INPUT -p tcp -m state --state INVALID,NEW,RELATED,ESTABLISHED -m tcp --dport 8080 -j ACCEPT
#apache daili
$IPT -A  OUTPUT -m state --state INVALID -j DROP
$IPT -A  OUTPUT -p tcp -m state --state ESTABLISHED -m tcp --sport 110 -j ACCEPT
$IPT -A  OUTPUT -p tcp -m state --state ESTABLISHED -m tcp --sport 8080 -j ACCEPT
$IPT -A  OUTPUT -p tcp -m state --state ESTABLISHED -m tcp --sport 80 -j ACCEPT
$IPT -A OUTPUT -p tcp --sport 8080  -s 192.168.252.132 -d 192.168.252.132  -j ACCEPT
$IPT -A OUTPUT -p tcp --dport 8080  -s 192.168.252.132 -d 192.168.252.132  -j ACCEPT
$IPT -A INPUT  -p tcp -j LOG --log-prefix "IPTABLES TCP-IN: "
#FTP
$IPT -A INPUT -p tcp --sport 20 -j ACCEPT
$IPT -A INPUT -p tcp --sport 21 -j ACCEPT
$IPT -A INPUT -p tcp --dport 30000:50000 -j ACCEPT
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A INPUT -m state --state ESTABLISHED -j ACCEPT
#ping
$IPT -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
$IPT -A INPUT -p icmp -m icmp --icmp-type 11 -j ACCEPT
$IPT -A OUTPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
$IPT -A OUTPUT -p icmp -m icmp --icmp-type 11 -j ACCEPT
#dns
# DNS
[ ! -z "$nameserver1" ] && $IPT -A OUTPUT -p udp -m udp -d $nameserver1 --dport 53 -j ACCEPT
[ ! -z "$nameserver2" ] && $IPT -A OUTPUT -p udp -m udp -d $nameserver2 --dport 53 -j ACCEPT



我實(shí)在找不出問題了。