I have a VPS running vsftpd v3.0.2 on CentOS 6.4. When I try to connect to my ftp server I get the error:

The data connection could not be established: EHOSTUNREACH - No route to host

The console of the attempt of connection:

Status: Connecting to xxx.xxx.xxx.xxx:21...
Status: Connection established, waiting for welcome message...
Response:   220 snapd.server01 FTP Server
Command:    AUTH TLS
Response:   234 Proceed with negotiation.
Status: Initializing TLS...
Status: Verifying certificate...
Command:    USER web01
Status: TLS/SSL connection established.
Response:   331 Please specify the password.
Command:    PASS *********
Response:   230 Login successful.
Command:    OPTS UTF8 ON
Response:   200 Always in UTF8 mode.
Command:    PBSZ 0
Response:   200 PBSZ set to 0.
Command:    PROT P
Response:   200 PROT now Private.
Status: Connected
Status: Retrieving directory listing...
Command:    PWD
Response:   257 "/"
Command:    TYPE I
Response:   200 Switching to Binary mode.
Command:    PASV
Response:   227 Entering Passive Mode (xxx,xxx,xxx,xxx,85,175).
Command:    LIST
Error:  The data connection could not be established: EHOSTUNREACH - No route to host

I have all required ports forwarded including 5000-5100. I have also tried disabling SElinux - didn't work. The user web01 home dir set to /var/www.

I did research the internet. Some said that in vsftpd.conf if I have spaces, that would cause the error but that is not the case.

  • Just ditch FTP and use scp/sftp. There is no good reason anyone needs to use FTP these days. – EEAA Jan 11 '14 at 16:05

Looks like an active/passive mode issue. Seems you use Passive mode.

I would try Active mode.

If you really want Passive mode, i suspect you didn't open all the required port (from TCP/1024 to TCP/65534).

Note that you can restrict port range for Passive mode using pasv_min_port and pasv_max_port directive in vsftpd.conf.

  • Both of the methods did the trick. I limited the range to 5000-5100 in the conf file and everything is working as it should. Many thanks – Karl Viiburg Jan 11 '14 at 16:12

Server for NAT?

vi /etc/sysconfig/iptables-config

  • That will not help, because the connection is FTPS (note TLS setup steps above) - the encryption of the control channel prevents the module from seeing the DATA connection request, and dynamically modifying the firewall rules accordingly. – MadHatter Dec 7 '15 at 7:52

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.