IPtables passive ftp rules donot work!

[MickyNQN]

Hello every body!
I'm trying to build a firewall with IPTables:

INTERNET <--------> (eth0) FIREWALL (eth1) <------------->FTP_srv

I set all rules DROP by default.

My rules for forwarding packet to FTP server:

#iptables -t nat -A PREROUTING -i eth1 -d $FIREWALL_EX_ADDR -p tcp --dport 21 -j DNAT --to-destination $FTP_ADDR:21
#iptables -A FORWARD -i eth0 -o eth1 -p tcp --dport 21 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
#iptables -A FORWARD -o eth0 -i eth1 -p tcp --sport 21 -m state --state ESTABLISHED,RELATED -j ACCEPT
#ACCEPT eth1 POSTROUTING

OK, now i can "ftp" to FTP_srv from INTERNET through firewall. But i cant listing and transfer data.

Then, i do the same with port 40000
( i configure vsftpd with pasv_min_port and pasv_max_port =40000 for Passive FTP)

But i cant listing FTP folder anyway T_T

Now, i try to set ACCEPT all rules, but i get same result T__T

Could you help me, please !

Sorry for my bad English!

[is977]

do you have in /etc/sysconfig/iptables-config stroke IPTABLES_MODULES="nf_conntrack_ftp"?

[MickyNQN]

Originally Posted by is977

do you have in /etc/sysconfig/iptables-config stroke IPTABLES_MODULES="nf_conntrack_ftp"?

Thank you so much !!! I forgot it