Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm unable to connect to my CentOS server via Active FTP.

I've installed and started vsftpd. I've loaded the ftp connection tracking module (/sbin/modprobe ip_conntrack_ftp).

Here is the output from /etc/sysconfig/iptables :

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -d 127.0.0.0/255.0.0.0 -i ! lo -j REJECT --reject-with icmp-port-unreachable
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 44444 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -p tcp -m tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --sport 20 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -j REJECT --reject-with icmp-port-unreachable
-A OUTPUT -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 20 -m state --state ESTABLISHED -j ACCEPT
COMMIT

[EDIT]

Turns out my iptable config was no good. Here is the correct version:

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -d 127.0.0.0/255.0.0.0 -i ! lo -j REJECT --reject-with icmp-port-unreachable
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 44444 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -j REJECT --reject-with icmp-port-unreachable
-A OUTPUT -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 21 -m state --state ESTABLISHED,RELATED -j ACCEPT
share|improve this question
    
Turns out my iptable rules were not correct. This is what I needed -A INPUT -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT -A OUTPUT -p tcp -m tcp --dport 21 -m state --state –  Mike Breen Aug 31 '09 at 19:45
    
If your new config solves your problem, you should really add it as an answer and select it as correct. –  Ophidian Aug 31 '09 at 21:29
add comment

4 Answers

whenever you trying to connect, are you on same network or you trying to connect through NAT? on neither end, because if at least one end goes through NATin you wont be able to do active connection period only PASV will work..

share|improve this answer
    
no that's not an issue here. –  Mike Breen Aug 31 '09 at 19:43
    
active connection only requires port 20,21 to be open so get rid of all states (just for test) and let port 20 and 21 go through, if you'll be able to make a connection then you can play around with states –  alexus Aug 31 '09 at 19:46
add comment

You need to load the conntrack module via editing /etc/sysconfig/iptables-config and modifying the line to read something like:

   IPTABLES_MODULES="ip_nat_ftp"

If you don't do this, then after your next reboot your FTP connections will suddenly stop working, for some settings of "passive" in the FTP client.

As far as your problem, which as you noticed as a firewall rule issue, I find it useful to test by telneting from the client to the server on port 21, for example:

   guin:Documents$ telnet ftp.tummy.com 21
   Trying 198.49.126.195...
   Connected to ftp.tummy.com.
   Escape character is '^]'.
   220 tummy.com, ltd. FTP server
   quit
   221 Goodbye.
   Connection closed by foreign host.
   zsh: exit 1     telnet ftp.tummy.com 21
   guin:Documents$ 

In this case it was working. If it just hangs at the "Trying", then it is because of the firewall rules.

share|improve this answer
add comment

What's the exact error message?

I often forget about the following settings in the config file. Make sure to check them.

userlist_file
userlist_enable
userlist_deny

Also, hosts.allow and hosts.deny may be the culprits here.

share|improve this answer
add comment
up vote 0 down vote accepted

Following Ophidian's suggestion:

Turns out my iptable rules were not correct. This is what I needed

-A INPUT -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT -A OUTPUT -p tcp -m tcp --dport 21 -m state --state`enter code here`
share|improve this answer
    
I'm not trying to do anything shady. I'm just doing what Ophidian asked. –  Mike Breen Oct 4 '09 at 23:18
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.