天际说

内核升级后iptables无法转发被动模式FTP的解决方案

发布时间:2018年11月14日 / 分类:运维经验 / 2,299 次围观 / 抢沙发!

https://serverfault.com/questions/849159/ftp-nat-stopped-working-after-kernel-upgrade


echo 1 > /proc/sys/net/netfilter/nf_conntrack_helper

you have to add specific rules to the raw table to attach those helpers. So for your example I think you need to add something like this:

iptables -t raw -A PREROUTING -d $public_ip -p tcp --dport 21 -j CT --helper ftp

That should also take care of making sure the helper modules are loaded without the explicit modprobe commands.


原因:

Recent kernels no longer automatically attach connection tracking helpers based on compiled in port numbers.

特别是装了带bbr之类的4.x内核之后

标签:none