iptables fails to load nf_conntrack_ftp

Question

I have recently had to rebuild my iptables configuration and when I run

service iptables restart

I now receive the following error line:

iptables: Loading additional modules: nf_conntrack_ftp   [FAILED]

My iptables-config file includes the following line:

IPTABLES_MODULES="nf_conntrack_ftp"

When I run modprobe nf_conntrack_ftp the response is:

FATAL: Module nf_conntrack_ftp not found.

Here's my iptables file:

Table: mangle Chain PREROUTING (policy ACCEPT) num target prot opt source destination

Chain INPUT (policy ACCEPT) num target prot opt source
destination 1 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0
state NEW tcp dpt:8447 2 ACCEPT tcp -- 0.0.0.0/0
0.0.0.0/0 state NEW tcp dpt:8443

Chain FORWARD (policy ACCEPT) num target prot opt source
destination

Chain OUTPUT (policy ACCEPT) num target prot opt source
destination

Chain POSTROUTING (policy ACCEPT) num target prot opt source
destination

Table: filter Chain INPUT (policy DROP) num target prot opt source destination 1 ACCEPT all -- 0.0.0.0/0
0.0.0.0/0 state RELATED,ESTABLISHED 2 DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x00 3 DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp flags:!0x17/0x02 state NEW 4 DROP tcp -- 0.0.0.0/0 0.0.0.0/0
tcp flags:0x3F/0x3F 5 ACCEPT all -- 0.0.0.0/0
0.0.0.0/0 6 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 7 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0
tcp dpt:443 8 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0
tcp dpt:25 9 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0
tcp dpt:995 10 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0
tcp dpt:143 11 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0
tcp dpt:993 12 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0
tcp dpt:22 13 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0
tcp dpt:110 14 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0
tcp dpt:465 15 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0
tcp dpt:8181 16 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0
tcp dpt:8443 17 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0

Chain FORWARD (policy ACCEPT) num target prot opt source
destination

Chain OUTPUT (policy ACCEPT) num target prot opt source
destination

It seems nf_conntrack_ftp isn't loading -- how do I load this?

Solution

Try issuing the following:

modprobe ip_conntrack & modprobe ip_conntrack_ftp

Then substitute nf_conntrack_ftp with ip_conntrack_ftp in your iptables configuration.

Comments

[Craig Miskell]

Last time I saw something similar, it was on Ubuntu, and someone had uninstalled the current kernel package, thus removing the module from /lib/modules/<version>/. Is this perhaps what's happened here?

[Michael Hampton]

Please post the output of the virt-what command (install it if it isn't present).

[Michael Hampton]

You'll need to contact your VPS provider, then.

[Zdenek]

My understanding is that nf_conntrack_ftp operates on its own without needing any iptables config. Try lsmod | grep conntrack to see if it's loaded; if not, find the file on your drive (it may have the .ko extension), change to that directory and use insmod or modprobe on that file including any extension. Check /etc/modules-load.d/nf_conntrack_ftp.conf for any mistakes. If the file doesn't exist, it will simply monitor port 21.

[user1780242]

If you would kindly delete your response, I would like to delete my question. Thanks for the help.

[Timo]

I get the error with ufw enable, what can I do?