I've installed vsFTPd in CentOS 5.5, on two servers, and added this rule to their iptables:

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT

Looks like this is not enough, since when I'm trying to upload a file from one server to another, I'm getting this result (IP address is masked):

# ftp
Connected to (
220 (vsFTPd 2.0.5)
Name ( vinny
331 Please specify the password.
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
227 Entering Passive Mode (99,99,99,99,107,74)
ftp: connect: No route to host

I've found a few articles in the net about the second rule I have to add to iptables, but I didn't find the right syntax for it. Could you please help?

ps. I have a default installation of vsFTPd and I don't want to change anything inside it's config file (/etc/vsftpd/vsftpd.conf), if possible.


Edit /etc/sysconfig/iptables-config and add this line:


Save it and restart iptables.
That's because passive mode use non standard ports to communicate, so you need to keep trak of the ftp connections and iptables will allow them when necessary.

  • worked for me and safed me a lot of time. thx! – user220539 May 21 '14 at 8:03
  • 1
    Note: in newer CentOS versions ip_conntrack_ftp has been renamed to nf_conntrack_ftp – Gerald Schneider Oct 30 '14 at 8:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.