Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm having a heck of a time creating a pf ruleset for FTP.

What I'm trying to do is :

Only allow $WHITELIST to connect to FTP port 21

Open ports 49152 - 65535 for Passive port range

Can anyone help me with this?

I have tried :


pass in quick on $EXT_IF proto tcp from { $FTPWHITELIST } to XX.XX.XX.XX port 21 keep state

pass in quick on $EXT_IF proto tcp from { $FTPWHITELIST } to XX.XX.XX.XX port 49512 >< 65535 keep state

share|improve this question
edited post to show what I have tried – Brian Smith Nov 29 '10 at 0:10
Do you have a default deny rule? Also, the default now is to keep state. How are you testing? – Rob Olmos Nov 29 '10 at 4:26
I do not have any default deny rule - I'm testing the rules on my home computer before throwing it on the production server. The only rule I have in PF is a port redirect for the postfix mail system. – Brian Smith Nov 29 '10 at 21:14

Have you tried what's mentioned in the FAQ:

FTP is a fairly convoluted algorithm that's evolved over the decades (it was created in 1971), and firewalls (and even TCP/IP) weren't invented yet, so getting it to work can be troublesome.

Try to make sure you use "passive" mode on your client/s.

If possible, try to use HTTP/S or SFTP (SSH FTP) if possible. They're both much cleaner, modern designs.

share|improve this answer
Ok, FTP is working fine - how do I make it so only certain IP's are allowed to access the FTP port? – Brian Smith Nov 29 '10 at 2:17

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.