Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am running ProFTPD Version 1.3.3c in active ftp mode and have the following firewall rules.

But whenever, I do directory listing, it is too slow. It takes time, but directory and files get listed.

As soon as I flush iptables rule, then it is fast. What I am missing in this rule ?

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:21 
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
DROP       all  --  0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination   
share|improve this question
add comment

3 Answers

Are you using passive FTP? If so you need to also open up a range of ports above 1023. It doesn't really matter which ports, but commonly 2000-3000 are used.

As a test if this is your problem, set your FTP client to ACTIVE (or whatever it names the opposite choice is PASSIVE) and see if you still have the same problem. If not, then you need to open some high ports to allow the passive stuff to happen.

share|improve this answer
    
Here's a good synopsis of the PASSIVE issue and firewalls. ncftp.com/ncftpd/doc/misc/… –  jdw Sep 26 '11 at 21:46
    
He says right in the question that they're using active mode. –  EEAA Sep 26 '11 at 21:51
add comment

You also need to open port TCP 20 for the data socket. link

share|improve this answer
add comment

Firstly, FTP has to be the worse protocol still in use. If at all possible you should use SSH instead.

Active FTP requires port 20 to be open ON THE CLIENT. This is clearly impossible in most cases and breaks all the rules of sane behaviour and firewall configuration. This is why most people just use passive FTP, which requires a range of high-numbered ports open on the server, in addition to port 21.

This site has more explanation, and some helpful diagrams: http://slacksite.com/other/ftp.html

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.