Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have recently set up vsftpd and whilst everything appears to be running fine and the server is listening on the correct port I cannot connect in using FTP clients.

A connection is established but whilst waiting for a welcome message it times out.

Googling the issue lead to lots of pages saying I should check my iptables, I know little about these but I have printed the results below.

My first question is I am guessing the iptables acts like a software firewall so presumably if I don't have it set up then all traffic should come in fine?

My second question is are iptables the most common but not only way of limiting what traffic can come in, and if it isn't the only is there anywhere else I should be looking?

Please request any additional information and I will edit the question appropriately.

EDIT

I have checked for any related logs and can't find anything of note.

When I try the command ftp localhost I get a timeout, so it looks like it may have nothing to do with IPTables but I don't know enough to totally rule it out.

The results of running telnet localhost ftp and telnet localhost ftp-data were timeouts, but they did try connecting to 127.0.0.1 which is what I would expect.

Here are my IP Tables;

Chain INPUT (policy DROP)
target     prot opt source               destination
fail2ban-ssh  tcp  --  anywhere             anywhere            multiport dports ssh
ACCEPT     tcp  --  anywhere             anywhere            multiport dports ssh,smtp,domain,www,https,ssmtp,xmpp-client,xmpp-server,5280,8999:9003
ACCEPT     udp  --  anywhere             anywhere            multiport dports domain
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere            multiport dports http-alt
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ftp state NEW
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED

Chain FORWARD (policy DROP)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED

Chain fail2ban-ssh (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere
share|improve this question
    
Does FTP work when you try to login from the server itself? How about logs under /var/log, do they have anything interesting about FTP? –  Janne Pikkarainen Jul 20 '11 at 9:57
    
The logs don't have anything interesting. When I do ftp localhost I also get a timeout, I will add this to my question thanks. –  Toby Jul 20 '11 at 10:22
1  
What is output of telnet localhost ftp and telnet localhost ftp-data? If still timeout - check if localhost really points to localhost. And you probably don't have /sbin/ in your PATH, so try using full path for iptables, like this - /sbin/iptables. –  AlexD Jul 20 '11 at 11:12
    
@AlexD Timeouts on them both (main question edited with this new information) and thanks for the tip about iptables, you were right. –  Toby Jul 20 '11 at 11:34

2 Answers 2

up vote 1 down vote accepted

"but they did try connecting to 127.0.0.1 which is what I would expect"

If that means it is also failing while attempting 127.0.0.1, then you might start by verifying that the server is actually running as the starting point.

share|improve this answer
    
It wasn't starting, tried various things to troubleshoot it but in the end just reinstalled it and it worked fine. –  Toby Jul 20 '11 at 13:53
    
Glad it worked out. –  user48838 Jul 21 '11 at 7:43

Try switching to passive mode in your FTP Client.

That can often help indicate whether there is a restriction in place at a firewall/router.

share|improve this answer
    
Thanks, passive mode was already on. –  Toby Jul 20 '11 at 10:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.