根据你的问题，我想你有一些普通的主机，有一些常见的应用程序，比如 web 浏览器、邮件客户端，可能是 telnet 和|或 ssh-client，也可能是 ftp-client，可能是一些 IM 等。并且拥有所有这些应用程序正常工作，您还需要允许此主机上的 FTP 服务器以主动和被动模式为将连接的客户端工作。以下是适用于这种情况的 3 条规则。通用规则块是适用于大多数客户端主机的极简规则集。接下来是 ftp-client 的规则块，如果您的主机上有这样的规则。ftp-client 的规则与其他客户端的规则略有不同：始终有两个连接来启用数据传输：ftp-control（端口 21）和 ftp-data（主动模式下的端口 20 或被动模式下的随机端口）。
FTP 服务器的规则在最后一块。
请检查内核中有 ip_conntrack_ftp （可能被命名为 nf_conntrack_ftp ）：
> lsmod | grep conn
如果您没有这个内核模块，“相关”规则将不起作用，并且很可能，单独的 ftp 数据连接将不会启动，而主 ftp 控制连接将在“PORT”命令之后的某个地方挂起。在这种情况下，您仍然可以强制执行 ftp 数据连接，但代价是降低了调整后的规则提供的安全性。调整位于规则之前的评论中。
临
#!/bin/bash
IPT=/sbin/iptables
$IPT -F
$IPT -t nat -F
$IPT -t mangle -F
$IPT -X
$IPT -t nat -X
$IPT -t mangle -X
/sbin/modprobe ip_conntrack
/sbin/modprobe ip_conntrack_ftp
$IPT -P INPUT DROP
$IPT -P FORWARD DROP
$IPT -P OUTPUT DROP
# Block of common rules #####################################################
$IPT -A OUTPUT -o lo -j ACCEPT
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A OUTPUT -p icmp -j ACCEPT
$IPT -A INPUT -p icmp -j ACCEPT
# allow DNS queries and replies
$IPT -A OUTPUT -p udp --dport 53 -j ACCEPT
$IPT -A INPUT -p udp --sport 53 -j ACCEPT
# allow all Your possible client applications to work
$IPT -A OUTPUT -p tcp -m multiport --dports ssh,telnet,http,https,xmpp-client,aol,smtp,pop3,imap2,imap3 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
$IPT -A INPUT -p tcp -m multiport --sports ssh,telnet,http,https,xmpp-client,aol,smtp,pop3,imap2,imap3 -m state --state RELATED,ESTABLISHED -j ACCEPT
# End of block of common rules ##############################################
# If You have ftp-client too, this block of rules
# will allow it to work with external ftp servers in both modes.
#
# First, allow ftp-control at client side:
$IPT -A OUTPUT -p tcp -m tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPT -A INPUT -p tcp -m tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT
#
# Then allow ftp-data Active Mode at client side:
# Client accepts RELATED connection from server port 20
# to client port number negotiated in ftp-control connection.
# nf_conntrack_ftp is REQUIRED at client host
# to pick up this client port number from payload of ftp-control packets,
# otherwise You are forced to use 'NEW' instead of 'RELATED'.
# And in the case of 'NEW' You allow connection to ANY port of Your host!
$IPT -A INPUT -p tcp -m tcp --sport 20 -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPT -A OUTPUT -p tcp -m tcp --dport 20 -m state --state ESTABLISHED -j ACCEPT
#
# Finally, allow ftp-data Passive Mode at client side:
# Client starts RELATED connection from random own high port number
# to server fixed high port number negotiated in ftp-control connection.
# nf_conntrack_ftp is REQUIRED again at client host
# to pick up this client port number from payload of ftp-control packets,
# otherwise You are forced to use 'NEW' instead of 'RELATED' !
-A OUTPUT -p tcp -m tcp --sport 1024:65535 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --sport 1024:65535 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
#######[ Block of rules needed for Local FTP Server ]#######
# This block of rules allows clients to access Your FTP server at this host
# either in Active or Passive mode.
# You may need to enable Passive mode in FTP server config file,
# e.g. with pasv_enable=yes in /etc/vsftpd.conf if vsftpd is Your choice.
#
# Ftp-control at server side:
# (some example rules are given below just to show
# how You can selectively restrict access to Your FTP server):
$IPT -A INPUT -s 1.2.3.0/24 -p tcp -m tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPT -A INPUT -s 5.6.7.8/32 -p tcp -m tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPT -A OUTPUT -p tcp -m tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT
#
# Ftp-data Active Mode at server side:
# Server starts RELATED connection from server port 20
# to client port number negotiated in ftp-control connection.
# nf_conntrack_ftp is REQUIRED to pick up this client port number
# from payload of ftp-control packets,
# otherwise You are forced to use 'NEW' instead of 'RELATED' !
$IPT -A OUTPUT -p tcp -m tcp --sport 20 -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPT -A INPUT -p tcp -m tcp --dport 20 -m state --state ESTABLISHED -j ACCEPT
#
# Ftp-data Passive Mode at server side:
# Server accepts RELATED client connection from random client high port number
# to own fixed high port number negotiated in ftp-control connection.
# nf_conntrack_ftp is REQUIRED to pick up this own fixed high port number
# from payload of ftp-control packets,
# otherwise You are forced to use 'NEW' instead of 'RELATED'.
# And in the case of 'NEW' You allow connection to ANY high port of Your server!
$IPT -A INPUT -p tcp -m tcp --sport 1024:65535 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPT -A OUTPUT -p tcp -m tcp --sport 1024:65535 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
######