Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've installed vsFTPd in CentOS 5.5, on two servers, and added this rule to their iptables:

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT

Looks like this is not enough, since when I'm trying to upload a file from one server to another, I'm getting this result (IP address is masked):

# ftp
Connected to (
220 (vsFTPd 2.0.5)
Name ( vinny
331 Please specify the password.
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
227 Entering Passive Mode (99,99,99,99,107,74)
ftp: connect: No route to host

I've found a few articles in the net about the second rule I have to add to iptables, but I didn't find the right syntax for it. Could you please help?

ps. I have a default installation of vsFTPd and I don't want to change anything inside it's config file (/etc/vsftpd/vsftpd.conf), if possible.

share|improve this question
up vote 4 down vote accepted

Edit /etc/sysconfig/iptables-config and add this line:


Save it and restart iptables.
That's because passive mode use non standard ports to communicate, so you need to keep trak of the ftp connections and iptables will allow them when necessary.

share|improve this answer
Works perfect, many thanks for your help! – yegor256 Jun 4 '10 at 5:55
worked for me and safed me a lot of time. thx! – user220539 May 21 '14 at 8:03
Note: in newer CentOS versions ip_conntrack_ftp has been renamed to nf_conntrack_ftp – Gerald Schneider Oct 30 '14 at 8:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.