Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have recently figured out that my VPS is running a distro of Linux that isn't exactly CentOS. It's CentOS in a OpenVZ/Virtuozzo container. For more information, see "When CentOS isn't CentOS." I would like to allow for FTP from behind my iptables firewall (FTP works fine when all rules are set to ACCEPT). Can anyone help with this?

share|improve this question
    
You're going to need to provide more information. For example: What does "isn't exactly CentOS" mean? What do your current firewall rules look like? –  jscott Apr 10 '12 at 0:56
1  
@jscott When CentOS isn't CentOS –  Wesley Apr 10 '12 at 0:58
    
@WesleyDavid Thanks for that, I didn't realize there was a FAQ for CentOS-like branches. –  jscott Apr 10 '12 at 1:02
1  
The port range is specified on vsFTPd with pasv_max_port=xxxxx and pasv_min_port=xxxxx. You also need pasv_enable=YES. Add a rule to ipTables matching whatever port range you specify in the vsFTPd config and you should be good to go - no kmods should be needed. –  cyberx86 Apr 10 '12 at 1:14
1  
By default, vsFTPd looks for /etc/vsftpd.conf (so you should put the directives there - check that they don't already exist though). It is possible, however, to override the default config location by passing a different file path to vsFTPd on the command line (which one of your init scripts might do). –  cyberx86 Apr 10 '12 at 1:27
show 6 more comments

1 Answer

up vote 1 down vote accepted

FTP comes in two varieties - active and passive. With active FTP the server requires ports 20 (data) and 21 (commands) open - it is easier to setup on the server, but harder to setup for the client (since the server initiates a connection back to the client). Testing active FTP is sometimes a good starting point to determine if your server's firewall is the cause of your problems.

Passive FTP is typically more universally compatible since the connections are established by the client. However, it requires port 21 (the command port) and another high numbered port to be open (for data transfer). Most FTP servers will allow you to specify a port range that will be used for passive FTP.

See this site for a good overview of the differences between active and passive FTP.

Kmods typically add features - by verifying that ACCEPT'ing all connections resolves your issue, you have largely shown that you do not need a kmod in this instance, but that there are simply some necessary ports that are blocked.

In your FTP config, setup the appropriate directives to define the passive port range that will be used, and then open these same ports in iptables, and you should be good to go.

PureFTPd:

There is a directive PassivePortRange:

PassivePortRange min_port max_port

vsFTPd: There are two directives pasv_max_port and pasv_min_port:

pasv_max_port=xxxxx
pasv_min_port=xxxxx

You also need to enable passive FTP with pasv_enable=YES.

By default, vsFTPd reads the configuration from /etc/vsftpd.conf (so you should put the directives there - check that they don't already exist though). It is possible, however, to override the default config location by passing a different file path to vsFTPd on the command line (which one of your init scripts might do).

Once you have specified the necessary ports, you can add them in a single ipTables command with:

iptables -A INPUT -p tcp -m tcp --dport xxxxx:xxxxx -j ACCEPT

(Note: FTP is exclusively TCP - you do not need to enable UDP)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.