Iptables, FTP, неадекватный провайдер, нестандартные порты.

Status:	Connecting to 11.22.33.44:33...
Status:	Connection established, waiting for welcome message...
Response:	220 (vsFTPd 2.2.2)
Command:	USER test
Response:	331 Please specify the password.
Command:	PASS *****************
Response:	230 Login successful.
Command:	OPTS UTF8 ON
Response:	200 Always in UTF8 mode.
Status:	Connected
Status:	Retrieving directory listing...
Command:	PWD
Response:	257 "/"
Command:	TYPE I
Response:	200 Switching to Binary mode.
Command:	PASV
Response:	227 Entering Passive Mode (11,22,33,44,172,49).
Command:	LIST
Error:	Connection timed out
Error:	Failed to retrieve directory listing

*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A POSTROUTING -o eth0 -s 192.168.1.0/24 ! -d 192.168.1.0/24  -j SNAT --to-source 11.22.33.44
COMMIT

*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:localnet_ssh - [0:0]
:localnet_rules - [0:0]
:wan_icmp - [0:0]
:wan_rules - [0:0]
:fwd_rules_out - [0:0]
:fwd_rules_in - [0:0]
:rate_limit - [0:0]

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth1 -j localnet_rules
-A INPUT -i eth0 -j wan_rules

-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A FORWARD -i eth1 -o eth0  -j fwd_rules_out
-A FORWARD -i eth0 -o eth1  -j fwd_rules_in

-A fwd_rules_out -p tcp -m tcp -m multiport --dports 21,53,80,443,465,993,995 -j ACCEPT
-A fwd_rules_out -p udp -m udp -m multiport --dports 53,123 -j ACCEPT
-A fwd_rules_out -j DROP

-A fwd_rules_in -j RETURN

-A localnet_rules -p tcp --dport 22 -j localnet_ssh
-A localnet_rules -m state --state NEW -j ACCEPT

-A localnet_ssh -s 192.168.1.105 -j ACCEPT
-A localnet_ssh -j DROP

-A wan_rules -p tcp -m tcp --dport 2121 -m state --state NEW,ESTABLISHED -j rate_limit
-A wan_rules -p tcp -m tcp --dport 44000:44100 -j ACCEPT
-A wan_rules -p icmp -j wan_icmp

-A rate_limit -p tcp --dport 2121 -m limit --limit 3/min --limit-burst 3 -j ACCEPT
-A rate_limit -p icmp --icmp-type echo-request -m limit --limit 3/sec -j ACCEPT
-A rate_limit -j LOG --log-prefix "IN DROP: "
-A rate_limit -j DROP

-A wan_icmp -p icmp --icmp-type address-mask-request -j DROP
-A wan_icmp -p icmp --icmp-type timestamp-request -j DROP
-A wan_icmp -p icmp --icmp-type echo-request -j rate_limit
-A wan_icmp --fragment -j DROP
-A wan_icmp -j ACCEPT
COMMIT

iptables -A INPUT -p tcp --dport 26000:26050 -m conntrack --ctstate NEW -m connlimit ! --connlimit-above 5 -j ACCEPT

# global options
listen=YES
listen_port=26050
pasv_enable=YES
pasv_min_port=26000
pasv_max_port=26049

# global options
listen=YES
listen_port=2121
pasv_enable=YES
pasv_min_port=44000
pasv_max_port=44100

iptables -A INPUT -p tcp --dport 26000:26050 -m conntrack --ctstate NEW -m connlimit ! --connlimit-above 5 -j ACCEPT

modprobe nf_conntrack_ftp ports=21,2121

Plasma ~ # modinfo nf_conntrack_ftp
filename:       /lib/modules/3.2.11-hardened-Plasma/kernel/net/netfilter/nf_conntrack_ftp.ko
alias:          nfct-helper-ftp
alias:          ip_conntrack_ftp
description:    ftp connection tracking helper
author:         Rusty Russell <rusty@rustcorp.com.au>
license:        GPL
depends:        nf_conntrack
intree:         Y
vermagic:       3.2.11-hardened-Plasma SMP mod_unload modversions KERNEXEC_BTS UDEREF REFCOUNT CONSTIFY_PLUGIN STACKLEAK_PLUGIN GRSEC
parm:           ports:array of ushort
parm:           loose:bool

options nf_conntrack_ftp ports=21,2121