0

I'm trying to give a third party access to a server via FTP on port 21.

I've been through hundreds of guides and answers but can't seem to come right.

The user is set up with password and has /home/username/ I've installed vsftpd and set up a userlist. I've added port 21 to /etc/ports.conf I've added port 21 and 20 to iptables in various ways. I've added ftp, 21, 20 with ufw I've restarted the services and the server

It's showing active in ufw

Status: active

 To                         Action      From
--                         ------      ----
 80                         ALLOW       Anywhere
 22                         ALLOW       Anywhere
 8080                       ALLOW       Anywhere
 21                         ALLOW       Anywhere
 443                        ALLOW       Anywhere
 20                         ALLOW       Anywhere
 21/tcp                     ALLOW       Anywhere
 80 (v6)                    ALLOW       Anywhere (v6)
 22 (v6)                    ALLOW       Anywhere (v6)
 8080 (v6)                  ALLOW       Anywhere (v6)
 21 (v6)                    ALLOW       Anywhere (v6)
 443 (v6)                   ALLOW       Anywhere (v6)
 20 (v6)                    ALLOW       Anywhere (v6)
 21/tcp (v6)                ALLOW       Anywhere (v6)

Netstat confirms its listening:

Active Internet connections (servers and established)
 Proto Recv-Q Send-Q Local Address           Foreign Address         State      
 tcp        0      0 10.0.0.4:16001          0.0.0.0:*               LISTEN     
 tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN     
 tcp        0      0 127.0.0.1:29131         0.0.0.0:*               LISTEN     
 tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN     
 tcp        0      0 0.0.0.0:21              0.0.0.0:*               LISTEN     
 tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN     
 tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN     

iptables showing

Chain ufw-user-input (1 references)
 target     prot opt source               destination         
 ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http
 ACCEPT     udp  --  anywhere             anywhere             udp dpt:http
 ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh
 ACCEPT     udp  --  anywhere             anywhere             udp dpt:ssh
 ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http-          alt
 ACCEPT     udp  --  anywhere             anywhere             udp dpt:http-     alt
 ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ftp
 ACCEPT     udp  --  anywhere             anywhere             udp dpt:fsp
 ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https
 ACCEPT     udp  --  anywhere             anywhere             udp dpt:https
 ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ftp-data
 ACCEPT     udp  --  anywhere             anywhere             udp dpt:20
 ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ftp

However, no matter what I do I can't seem to access it via a remote client. nmap shows port is filtered

Nmap scan report for xx.xx.xx.xx
Host is up, received syn-ack (0.031s latency).
PORT   STATE    SERVICE REASON
21/tcp filtered ftp     no-respons

I am also running CloudFlare, but am using the IP address to FTP and have added that as a DNS rule to CloudFlare anyway.

What other firewalls or methods could be blocking the connections? I don't no where else to look...

Your help is much appreciated.

1
  • // For the brave souls who made it this far, you are the chosen ones.... ANSWER: You have to add additional port(s) one by one (e.g. 25000, 25001 etc.) in addition to FTP 21 in the Azure NSG, and obviously allow the same ports through firewall (e.g. ufw), in order to get a passive mode upload. FTP conf must also specifically use passive mode through the same ports. And don't forget to restart all your services :D Commented Jul 29, 2016 at 21:55

1 Answer 1

0

Adding it as as an answer since i can't comment.

Can you also double check security group if instance is hosted on AWS or NSG if hosted on Microsft Azure?

1
  • This was effectively the right answere @Sachin, so thanks. Commented Jul 29, 2016 at 21:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .