firewall entries needed for active FTP connections for linux hosts running recent kernels

after upgrade to debian stretch i had to add the following firewall entries:

for the FTP servers:

iptables -t raw -A PREROUTING -p tcp --dport 21 -j CT --helper ftp

for the nat-routers between FTP servers and FTP clients:

iptables -t raw -A PREROUTING -p tcp --dport 21 -j CT --helper ftp

for the FTP clients:

iptables -t raw -A OUTPUT -p tcp --dport 21 -j CT --helper ftp

related articles:

• https://home.regit.org/netfilter-en/secure-use-of-helpers/