0

I'm unable to connect to my CentOS server via Active FTP.

I've installed and started vsftpd. I've loaded the ftp connection tracking module (/sbin/modprobe ip_conntrack_ftp).

Here is the output from /etc/sysconfig/iptables :

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -d 127.0.0.0/255.0.0.0 -i ! lo -j REJECT --reject-with icmp-port-unreachable
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 44444 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -p tcp -m tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --sport 20 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -j REJECT --reject-with icmp-port-unreachable
-A OUTPUT -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 20 -m state --state ESTABLISHED -j ACCEPT
COMMIT

[EDIT]

Turns out my iptable config was no good. Here is the correct version:

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -d 127.0.0.0/255.0.0.0 -i ! lo -j REJECT --reject-with icmp-port-unreachable
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 44444 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -j REJECT --reject-with icmp-port-unreachable
-A OUTPUT -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 21 -m state --state ESTABLISHED,RELATED -j ACCEPT
2
  • Turns out my iptable rules were not correct. This is what I needed -A INPUT -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT -A OUTPUT -p tcp -m tcp --dport 21 -m state --state
    – Mike Breen
    Aug 31, 2009 at 19:45
  • If your new config solves your problem, you should really add it as an answer and select it as correct.
    – Ophidian
    Aug 31, 2009 at 21:29

4 Answers 4

0

whenever you trying to connect, are you on same network or you trying to connect through NAT? on neither end, because if at least one end goes through NATin you wont be able to do active connection period only PASV will work..

2
  • no that's not an issue here.
    – Mike Breen
    Aug 31, 2009 at 19:43
  • active connection only requires port 20,21 to be open so get rid of all states (just for test) and let port 20 and 21 go through, if you'll be able to make a connection then you can play around with states
    – alexus
    Aug 31, 2009 at 19:46
0

You need to load the conntrack module via editing /etc/sysconfig/iptables-config and modifying the line to read something like:

   IPTABLES_MODULES="ip_nat_ftp"

If you don't do this, then after your next reboot your FTP connections will suddenly stop working, for some settings of "passive" in the FTP client.

As far as your problem, which as you noticed as a firewall rule issue, I find it useful to test by telneting from the client to the server on port 21, for example:

   guin:Documents$ telnet ftp.tummy.com 21
   Trying 198.49.126.195...
   Connected to ftp.tummy.com.
   Escape character is '^]'.
   220 tummy.com, ltd. FTP server
   quit
   221 Goodbye.
   Connection closed by foreign host.
   zsh: exit 1     telnet ftp.tummy.com 21
   guin:Documents$ 

In this case it was working. If it just hangs at the "Trying", then it is because of the firewall rules.

0

What's the exact error message?

I often forget about the following settings in the config file. Make sure to check them.

userlist_file
userlist_enable
userlist_deny

Also, hosts.allow and hosts.deny may be the culprits here.

0
0

Following Ophidian's suggestion:

Turns out my iptable rules were not correct. This is what I needed

-A INPUT -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT -A OUTPUT -p tcp -m tcp --dport 21 -m state --state`enter code here`
1
  • I'm not trying to do anything shady. I'm just doing what Ophidian asked.
    – Mike Breen
    Oct 4, 2009 at 23:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .