2

My FTP server is a CentOS 5.4 with VSFTPD.

When I try to ls after connecting to my server using FTP I get this :

ftp> ls
229 Entering Extended Passive Mode (|||12206|)
ftp: Can't connect to `000.000.000.000': Connection refused
500 Illegal PORT command.
425 Use PORT or PASV first.

I can do mkdir without any problem.

When I connect from the same server to my ftp server I have no problem.

Port 20 and 21 are open in my iptable. How can I fix that?

Thanks!!

UPDATE :

telnet myftpserver.com 20
Trying 000.000.000.000...
telnet: connect to address 000.000.000.000: Connection refused
telnet: Unable to connect to remote host

and

[root@internal vsftpd]# /sbin/iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
RH-Firewall-1-INPUT  all  --  0.0.0.0/0            0.0.0.0/0           
SSH_CHECK  tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:22 state NEW 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
RH-Firewall-1-INPUT  all  --  0.0.0.0/0            0.0.0.0/0           

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain RH-Firewall-1-INPUT (2 references)
target     prot opt source               destination         
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:33988 
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:3306 
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:20 
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:21 
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:80 
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 255 
ACCEPT     esp  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     ah   --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     udp  --  0.0.0.0/0            224.0.0.251         udp dpt:5353 
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:631 
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:631 
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22 
REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited 

Chain SSH_CHECK (1 references)
target     prot opt source               destination         
           all  --  0.0.0.0/0            0.0.0.0/0           recent: SET name: SSH side: source 
DROP       all  --  0.0.0.0/0            0.0.0.0/0           recent: UPDATE seconds: 60 hit_count: 4 name: SSH side: source 
3
  • That '000.000.000.000' doesn't look good. What's wrong with your DNS?
    – Bill Weiss
    Mar 2, 2010 at 19:12
  • I think he was obfuscating his IP. I guess it would be good to point out to the OP that XXX.XXX.XXX.XXX is the preferred method.
    – einstiien
    Mar 2, 2010 at 23:47
  • Yes I was obfuscating my IP. I will use XXX next time. Thanks!
    – benjisail
    Mar 3, 2010 at 9:51

1 Answer 1

4

The problem is related to the fact that Passive FTP uses ports other than 20 and 21. Read about it here: http://slacksite.com/other/ftp.html

Usually I will setup a port range in the vsftpd.conf file for the Passive FTP and then open these ports on the firewall.

Also, I'm mostly a freebsd guy but I'm pretty sure there is a way on linux to dynamically open the FTP PASV ports but someone else will have to chime in on that one. I'll look and see what I can find.

In Linux, running the command:

modprobe ip_conntrack_ftp

should correct the connection issue when 'Entering Extended Passive Mode'.

EDIT:

First hit on google: http://www.cyberciti.biz/faq/iptables-passive-ftp-is-not-working/

Better explanation: http://www.sns.ias.edu/~jns/wp/2006/01/12/iptables-connection-tracking-ftp/

5
  • For netfilter and passive FTP in Linux, make sure the ip_conntrack_ftp module is loaded or compiled in if monolith. lsmod to list and modprobe to load. Ha, TFA says that too.
    – Warner
    Mar 2, 2010 at 17:39
  • @warner, Thank you, yeah that's what I found in that second link I posted.
    – einstiien
    Mar 2, 2010 at 17:40
  • What is doing ip_conntrack_ftp?
    – benjisail
    Mar 2, 2010 at 17:44
  • What it does is monitor the FTP traffic for the PORT command being sent out to the client. When it sees this command it looks at the port that vsftpd is opening (a random port > 1024) and then dynamically opens this port in the firewall.
    – einstiien
    Mar 2, 2010 at 17:50
  • You also need to add the rules mentioned in the link above, a better explanation is here: sns.ias.edu/~jns/wp/2006/01/12/iptables-connection-tracking-ftp
    – einstiien
    Mar 2, 2010 at 18:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .