Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What iptables rules do I need client side to allow active ftp.

I currently unable to connect to ftp via active mode when iptables is running, however if I stop IPTABLES everything works fine. Passive mode works either (as no inbound connection is required).

share|improve this question
up vote 1 down vote accepted

Basically, in active mode during transfers the client will sometimes listen on a random port and have the server connect to that port and start sending data. If you are behind a firewall the inbound connection from the FTP server fails, unless the firewall is capable of snooping on the traffic, and opening the incoming port.

Since the listening port is chosen by the client behind the firewall randomly, you would have to open every port for this to work. Obviously that is not a solution. However many FTP applications can be configured to use a small set of ports for active connections. You need to configure your FTP client to use a fixed range of ports and then add iptables rules to allow inbound connections to those ports.

In the end, I strongly recommend passive mode FTP. The only exception is if you have a really old FTP server that doesn't support it.


share|improve this answer
So I should depend on my FTP client to open the inbound data port. I am using curl which could be part of the problem. I am using passive, but we need this feature to support both. Anyone know of any linux ftp clients that will open the port for me? – user60752 Nov 18 '10 at 19:12
cUrl added an option for this in 7.15.2: --local-port <num>[-num] "Set a preferred number or range of local port numbers to use for the connection(s). Note that port numbers by nature are a scarce resource that will be busy at times so setting this range to something too narrow might cause unnecessary connection setup failures." Pick a range of ports and open those ports up in IPtables. – mfarver Nov 18 '10 at 22:07

The following website is very helpful and should help you in constructing the rulesets that you are asking about.

share|improve this answer

This is handled by a helper module. Is the nf_conntrack_ftp helper loaded? Do your rules allow related connections? If both these conditions apply you should be able to use active FTP. See for the concepts which apply. I believe the modules have been renamed since it was written.

share|improve this answer

In passive the server opens the unpriviledged port > 1024, and in active its the client which does this.

If passive is not an option keep in mind it lessens the exposure however if you specify a limited number of ports for the range to use this should help as a solution.

share|improve this answer
So the client should be opening whichever port the server wants to come back on? Is this random? If this is so is there anyway to configure the client (which has a firewall) to open this inbound port? – user60752 Nov 18 '10 at 18:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.