Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

My Netgear router randomly reset itself the other day loosing all of my config settings: DSL details, Firewall rules, the lot!

So I set about restoring all of the details manually, but when it came to configuring the firewall I wanted improve the security by explicitly setting 'deny' rules for everything that I figured is 'non-essential', and (although not necessary) whilst I was at it I set explicit 'allow' for the 'essential' protocols.

I'll admit now I didn't really know what I was doing and everything was just 'my best guess', but I enabled only DNS, HTTP, HTTPS, FTP, SFTP, TFTP with everything else blocked.

This did not work for me as I could not access 99% of web sites (although strangely Google worked!), so I played around a bit more and found that (oddly) if I disabled just the explicit 'allow' rules then everything worked fine, for browsing anyway.

Today I came to work on some web-sites via FTP (edit: I use FileZilla on Linux) and just could not get a consistent connection, it kept dropping out after a few files or being blocked by the server or simply not connecting. It would authenticate okay but then stop when retrieving the initial directory listing! e.g.:

Status: Delaying connection for 1 second due to previously failed connection attempt...
Status: Resolving address of ftp.domain.co.uk
Status: Resolving address of ftp.domain.co.uk
Status: Connecting to 123.123.123.123:21...
Status: Connecting to 123.123.123.123:21...
Status: Connection established, waiting for welcome message...
Status: Connection established, waiting for welcome message...
Response:   421 Too many connections (8) from this IP
Error:  Could not connect to server
Status:     Delaying connection for 5 seconds due to previously failed connection attempt...
Response:   421 Too many connections (8) from this IP
Error:  Could not connect to server
Status: Delaying connection for 5 seconds due to previously failed connection attempt...


I've checked and re-checked the FTP settings (they worked before anyway), I have Googled the I.T. out of the various protocols that I have blocked in the fire-wall but none seem essential to FTP (other than FTP/SFTP etc. which I have passively enabled).

I'm (clearly) no server engineer, or protocols / fire-wall expert so I was hoping that some one could maybe shed some light on why my FTP is failing. I've been wondering if I ought to be allowing BGP, BOOTP and/or IDENT (or any others)?

What other protocols are required for FTP?


Thanks in advance!

share|improve this question

closed as off topic by HopelessN00b, Michael Hampton, Joel E Salas, Zoredache, rnxrx Sep 24 '12 at 0:54

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

2  
If you actually read the Response: from the FTP server you will see 421 Too many connections (8) from this IP. I think it's pretty obvious what you should do to resolve this. –  Michael Hampton Sep 21 '12 at 15:39
    
Really? What's that? AFAIK I am not opening more than one connection at any one time from my IP, why would I. I just load up FileZilla, connect to the server and upload the files! –  Chris Sep 21 '12 at 16:02

2 Answers 2

The answer to your question

FTP operates over TCP - so no other protocols need to be permissible.

But bear in mind that in addition to port 21 (and possibly port 20) needing to be open, if you are using FTP PASV - then you'll also need to open another range of ports - specifically for passive, as defined in your FTP config.

For vsftpd it looks something like this.

pasv_min_port=20000
pasv_max_port=21000
pasv_enable=YES

Your issue

... isn't anything to do with blocked protocols, just read the error ...

Response:   421 Too many connections (8) from this IP
Error:  Could not connect to server
share|improve this answer

Not a firewall issue.

The issue here is the FTP server is rejecting the connections, because there are already "too many" connections to the server from that IP.

Response: 421 Too many connections (8) from this IP

Increase the connection limit to more than 8 through your FTP server's configurations, and/or figure out if those connections are in use and terminate any any excess ones.

In response to comment:

@Chris yes, that is a message from the server. The server detected too many connections from your IP and dropped them.

Your other FTP issues are likely related to the way your, or the other servers handle/mangle PASV FTP connections. Especially when issuing an ls command, the failure usually means that a firewall or filter/proxy at one end is not accepting the new "passive" connection generated for issuing commands or transferring files.

For those issues, try using active FTP mode, try removing the firewalls from the equation, and try using SFTP (FTP over SSH) to diagnose and/or eliminate the problems.

share|improve this answer
    
I agree with both you and @sonassi that the FTP error says 'too many connections' but I have not set a connection limit in my FTP (FileZilla). Could the server set one? Does an FTP program establish more than one connection at once? Also this does not explain my other drop outs and failures to connect to different servers on different hosts! –  Chris Sep 21 '12 at 15:59
    
@Chris see update. –  HopelessN00b Sep 21 '12 at 16:06
    
Thanks, but none of the server's have SSL certificates for SFTP but I do use 'FTP over explicit TLS' wherever possible. I updated my question to include that my FTP program is FileZilla, I'm not using SSH so not (myself) issuing 'ls' commands. Also FileZilla auto detects passive / active connections -- plus all of these servers and settings have worked for me before with no problems. The problems only occurred after my router/fire-wall reset! –  Chris Sep 21 '12 at 16:20
    
@Chris Your FTP CLIENT is FileZilla. Your FTP SERVER is generating the message you're seeing (FileZilla is just showing it to you) -- for some reason it thinks there are already 8 connections from your IP. You must either (a) Find and kill the other connections on your (client) side, or (b) Tell the server to accept more than 8 connections, by changing its configuration. –  voretaq7 Sep 21 '12 at 16:29
    
Thanks @voretaq7 I realise that, only I have no control over the server's settings, it's just a host for one of my clients. I have no idea how/why there are 8 connection being opened from my IP, unless FileZilla automatically tries to open multiple simultaneous connections to transfer files quicker? edit I've checked my FZ settings and 'Maximum simultaneous transfers' is set to 2. Sorry I really don't know why this is messed up! –  Chris Sep 21 '12 at 16:31

Not the answer you're looking for? Browse other questions tagged or ask your own question.