Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My FTP server is a CentOS 5.4 with VSFTPD.

When I try to ls after connecting to my server using FTP I get this :

ftp> ls
229 Entering Extended Passive Mode (|||12206|)
ftp: Can't connect to `': Connection refused
500 Illegal PORT command.
425 Use PORT or PASV first.

I can do mkdir without any problem.

When I connect from the same server to my ftp server I have no problem.

Port 20 and 21 are open in my iptable. How can I fix that?



telnet 20
telnet: connect to address Connection refused
telnet: Unable to connect to remote host


[root@internal vsftpd]# /sbin/iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
RH-Firewall-1-INPUT  all  --             
SSH_CHECK  tcp  --             tcp dpt:22 state NEW 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
RH-Firewall-1-INPUT  all  --             

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain RH-Firewall-1-INPUT (2 references)
target     prot opt source               destination         
ACCEPT     tcp  --             tcp dpt:33988 
ACCEPT     tcp  --             tcp dpt:3306 
ACCEPT     tcp  --             tcp dpt:20 
ACCEPT     tcp  --             tcp dpt:21 
ACCEPT     tcp  --             tcp dpt:80 
ACCEPT     all  --             
ACCEPT     icmp --             icmp type 255 
ACCEPT     esp  --             
ACCEPT     ah   --             
ACCEPT     udp  --           udp dpt:5353 
ACCEPT     udp  --             udp dpt:631 
ACCEPT     tcp  --             tcp dpt:631 
ACCEPT     all  --             state RELATED,ESTABLISHED 
ACCEPT     tcp  --             state NEW tcp dpt:22 
REJECT     all  --             reject-with icmp-host-prohibited 

Chain SSH_CHECK (1 references)
target     prot opt source               destination         
           all  --             recent: SET name: SSH side: source 
DROP       all  --             recent: UPDATE seconds: 60 hit_count: 4 name: SSH side: source 
share|improve this question
That '' doesn't look good. What's wrong with your DNS? – Bill Weiss Mar 2 '10 at 19:12
I think he was obfuscating his IP. I guess it would be good to point out to the OP that XXX.XXX.XXX.XXX is the preferred method. – einstiien Mar 2 '10 at 23:47
Yes I was obfuscating my IP. I will use XXX next time. Thanks! – benjisail Mar 3 '10 at 9:51
up vote 4 down vote accepted

The problem is related to the fact that Passive FTP uses ports other than 20 and 21. Read about it here:

Usually I will setup a port range in the vsftpd.conf file for the Passive FTP and then open these ports on the firewall.

Also, I'm mostly a freebsd guy but I'm pretty sure there is a way on linux to dynamically open the FTP PASV ports but someone else will have to chime in on that one. I'll look and see what I can find.

In Linux, running the command:

modprobe ip_conntrack_ftp

should correct the connection issue when 'Entering Extended Passive Mode'.


First hit on google:

Better explanation:

share|improve this answer
For netfilter and passive FTP in Linux, make sure the ip_conntrack_ftp module is loaded or compiled in if monolith. lsmod to list and modprobe to load. Ha, TFA says that too. – Warner Mar 2 '10 at 17:39
@warner, Thank you, yeah that's what I found in that second link I posted. – einstiien Mar 2 '10 at 17:40
What is doing ip_conntrack_ftp? – benjisail Mar 2 '10 at 17:44
What it does is monitor the FTP traffic for the PORT command being sent out to the client. When it sees this command it looks at the port that vsftpd is opening (a random port > 1024) and then dynamically opens this port in the firewall. – einstiien Mar 2 '10 at 17:50
You also need to add the rules mentioned in the link above, a better explanation is here: – einstiien Mar 2 '10 at 18:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.