Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My IPTables rules are as follows:

# Generated by iptables-save v1.4.4 on Mon Aug 23 18:34:35 2010
:OUTPUT ACCEPT [9356:4246018]
-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 6685 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8000 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8089 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 20 -j ACCEPT

This is blocking FTP which I'm not sure why. FTP is indeed on port 21 as it as not been changed. I'm using VSFTPD. When I clear all IPTables rules I am able to use FTP just fine.

share|improve this question
Have you tried using passive FTP? – PP. Aug 28 '10 at 16:20
In the ubuntu guide it mentioned enabling passive FTP, but I couldn't do that because what it said to do wasn't there... now I can't find the guide... – Webnet Aug 28 '10 at 16:43
Are you sure this is a firewall problem, have you tried to turn it of for a few seconds and access your FTP server ? Also the rule -A INPUT -j DROP should come before the ftp rules. – Prix Aug 28 '10 at 17:15
When I dump the rules, I can FTP just fine – Webnet Aug 28 '10 at 19:58
up vote 1 down vote accepted

Have you loaded the ip_conntrack_ftp kernel module?

The ip_conntrack_ftp module "knows" about the ftp protocol and watches incoming connection to port 21 to work out what port the connection is going to use for data and then opens that port.

You don't need to use passive then.

However if you want to use passive, then that is nothing to do with vsftpd, that is a client side option.

I.e. the client user needs to set up his client to use passive mode.

share|improve this answer
Do I just need to load the module and it'll work or do I need to do anything else? – Webnet Aug 28 '10 at 19:57
@Webnet the related allow should take care of it, so it should just work – Joris Aug 28 '10 at 20:21
Ohh, so you're saying that if I load this module I don't need to open IPTables, the ip_conntrack_ftp module opens them on IPTables when they're received? – Webnet Aug 28 '10 at 21:47

Throw in these lines, then check your syslog to see what traffic is being blocked:

-A INPUT -p tcp -m tcp --dport 20 -j LOG
-A INPUT -p tcp -m tcp --dport 21 -j LOG
-A OUTPUT -p tcp -m tcp --sport 20 -j LOG
-A OUTPUT -p tcp -m tcp --sport 21 -j LOG
share|improve this answer
I cleared syslog so I could see these errors easier. It appears it's not logging anything unless I'm not looking in the right place. – Webnet Aug 28 '10 at 16:39
Any ideas on where I can find these logs? If they are in syslog and I just can't find them, what should I be looking for specifically? – Webnet Aug 31 '10 at 15:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.