Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How do you whitelist IPs for the service to allow only certain subnets on? Do I use IPTables or is there an easier way like IPWrappers Do you have to register the service for it to work with IPWrappers(hosts.allow)

share|improve this question
up vote 2 down vote accepted

If your vsftpd has been compiled with tcp_wrappers support then you can use it if you turn on the vsftpd configurstion option


If enabled, and vsftpd was compiled with tcp_wrappers support, incoming connections will be fed through tcp_wrappers access control. Furthermore, there is a mechanism for per-IP based configuration. If tcp_wrappers sets the VSFTPD_LOAD_CONF environment variable, then the vsftpd session will try and load the vsftpd configuration file specified in this variable.

You can then use the standard hosts.allow and hosts.deny files.

You can check to see if your vsftpd has been compiled with libwrap support like so

ldd /usr/sbin/vsftpd | grep wrap => /lib64/ (0x00002ae164bb6000)
share|improve this answer

The easiest way would be to use iptables:

iptables -A INPUT -s -p tcp --dport 21 -j ACCEPT
iptables -A INPUT -s -p tcp --dport 21 -j ACCEPT
iptables -A INPUT -p tcp --dport 21 -j DROP

to allow from and and dissallow from everyone else.

Don't forget to save iptables configuration (depends on your linux distro), so it will survive reboot.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.