Debian Blocked IP's

Question

I am debugging access to a remote service via. my Debian VPS. IPTables is used and allows outward port 21 traffic. The remote service is an FTP server (which I can access from my own PC and is not blocked by the remote service). I have also checked that Debian can access FTP servers (which it can).

I am wondering, what might Debian be using to block the IP? IPTables shows no blocked IP addresses. I also have dos-deflate installed although I have set that up for iptables. Any ideas on what might be blocking the connection?

PS: I get a "Connection Refused" when trying to use WGET to access the remote FTP (wget works with another FTP I used for testing).

Answer 1

It will probably give the same issue, but try doing a telnet to the remote IP telnet ip_address 21 to ensure it's an IP/port issue. If that says refused but you can FTP other networks (make sure they are other networks) then it's a firewall issue.

Post your IPTables above (I know you say it's not the cause, but just to make sure!). You can also try asking your hosting provider to ensure that they're not blocking 21 outbound to that IP (extremely unlikely). Finally, ask the FTP service why they're blocking your IP address.

Answer 2

FTP uses two ports, one for data transfer, the other for control. 21 is the control port, 20 the data port.

You should open port 20 too (and this is active FTP, for passive FTP you need to open the ports used by your FTP software too)

Answer 3

It might be helpful if you can pinpoint exactly where your packets are being dropped. hping is pretty hand for this.

You can make your own traceroute on port 21 by incrementing the TTL (-t) from 1 - 10 as follows:

for i in `seq 20`; 
  do echo "+++++ TTL IS: $i +++++"; 
  sudo hping3 -t $i -S ftp.example.com -p 21 -c 1; 
done

Packets returned because the TTL is too low will show: TTL 0 during transit from ip= name=UNKNOWN

When you start getting 100% packet loss you'll know where to start looking.