Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a legacy app that needs FTP and cannot do SFTP.

My solution is:

  • put an FTP server in place using VSFTPD
  • configure the firewall to accept port 21 connections only from localhost
  • Set up an SSH connection from the client with the legacy app
  • Tunnel the FTP through SSH

I'm wondering though if I can configure VSFTPD to ignore connections from anywhere but localhost on its own, in addition to the firewall. Belt and bracers both.

share|improve this question
up vote 15 down vote accepted

Yes. Configure the vsftp server to listen only on this can be done in the vsftp.conf file:


To use this parameter, the server needs to be in standalone mode:


If you want to use IPv6, use these entries instead:


This is the same as the first, but uses IPv6.

You'll almost certainly have to restart to make this work.

share|improve this answer
My config file needed an '=' between the listen_address and the – Akber Choudhry Oct 13 '13 at 11:18
My config also required the '=' between property and value – David Aug 25 '14 at 18:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.