Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've installed vsFTPd in CentOS 5.5, on two servers, and added this rule to their iptables:

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT

Looks like this is not enough, since when I'm trying to upload a file from one server to another, I'm getting this result (IP address is masked):

# ftp 99.99.99.99
Connected to 99.99.99.99 (99.99.99.99).
220 (vsFTPd 2.0.5)
Name (99.99.99.99:root): vinny
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
227 Entering Passive Mode (99,99,99,99,107,74)
ftp: connect: No route to host

I've found a few articles in the net about the second rule I have to add to iptables, but I didn't find the right syntax for it. Could you please help?

ps. I have a default installation of vsFTPd and I don't want to change anything inside it's config file (/etc/vsftpd/vsftpd.conf), if possible.

share|improve this question
add comment

1 Answer

up vote 4 down vote accepted

Edit /etc/sysconfig/iptables-config and add this line:

IPTABLES_MODULES="ip_conntrack_ftp"

Save it and restart iptables.
That's because passive mode use non standard ports to communicate, so you need to keep trak of the ftp connections and iptables will allow them when necessary.

share|improve this answer
    
Works perfect, many thanks for your help! –  yegor256 Jun 4 '10 at 5:55
    
worked for me and safed me a lot of time. thx! –  user220539 May 21 at 8:03
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.