I have recently figured out that my VPS is running a distro of Linux that isn't exactly CentOS. It's CentOS in a OpenVZ/Virtuozzo container. For more information, see "When CentOS isn't CentOS." I would like to allow for FTP from behind my iptables firewall (FTP works fine when all rules are set to ACCEPT). Can anyone help with this?
FTP comes in two varieties - active and passive. With active FTP the server requires ports 20 (data) and 21 (commands) open - it is easier to setup on the server, but harder to setup for the client (since the server initiates a connection back to the client). Testing active FTP is sometimes a good starting point to determine if your server's firewall is the cause of your problems.
Passive FTP is typically more universally compatible since the connections are established by the client. However, it requires port 21 (the command port) and another high numbered port to be open (for data transfer). Most FTP servers will allow you to specify a port range that will be used for passive FTP.
See this site for a good overview of the differences between active and passive FTP.
Kmods typically add features - by verifying that ACCEPT'ing all connections resolves your issue, you have largely shown that you do not need a kmod in this instance, but that there are simply some necessary ports that are blocked.
In your FTP config, setup the appropriate directives to define the passive port range that will be used, and then open these same ports in iptables, and you should be good to go.
There is a directive
There are two directives
You also need to enable passive FTP with
By default, vsFTPd reads the configuration from
Once you have specified the necessary ports, you can add them in a single ipTables command with:
(Note: FTP is exclusively TCP - you do not need to enable UDP)