I am trying to install vsftpd on Centos 7. I can connect to the server from localhost, but not connect to it from remote machines. I am somewhat new to the topic of system and network administration.
Here are some places I've looked for answers:
Can not open ftp port via firewalld
Centos does not open port/s after the rule/s are appended
Port 80 filtered nmap
I have the vsftpd service up and running:
> netstat -plnt | grep ':21. ' tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN 12393/vsftpd
and I can log in using
ftp localhost just fine. But when I attempt a remote login, I get "connection timed out" after several seconds. So I'm suspecting a firewall issue.
(Also, from FTP port closed for vsftpd service
lsof -i:21 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME vsftpd 12393 root 3u IPv4 63746670 0t0 TCP *:ftp (LISTEN)
Since this is Centos, I'm using firewalld. Port 21 appears to be open:
> firewall-cmd --list-services dhcpv6-client ftp https ssh
> firewall-cmd --list-ports 433/tcp 21/tcp 80/tcp 20/tcp
> firewall-cmd --get-default-zone public > firewall-cmd --get-active-zone public interfaces: enp0s25
and I have reloaded firewalld via
But if I try nmap from a remote machine, it claims ports 20 and 21 are filtered:
> nmap -p20,21 my.ftp.server.com Starting Nmap 6.40 ( http://nmap.org ) at 2017-03-27 13:48 PDT Nmap scan report for rrcs-xx-xx-xx-xx (xx.xx.xx.xx) Host is up (0.035s latency). PORT STATE SERVICE 20/tcp filtered ftp-data 21/tcp filtered ftp
I even tracked looked through all the iptables rules, following firewalld's various chains, and found these:
> iptables -S IN_public_allow -N IN_public_allow -A IN_public_allow -p tcp -m tcp --dport 21 -m conntrack --ctstate NEW -j ACCEPT -A IN_public_allow -p tcp -m tcp --dport 20 -m conntrack --ctstate NEW -j ACCEPT
I'm happy to post the entire output of
iptables -S if anyone thinks it would help.
Finally, I have switched off SELinux for just long enough to determine that I get the same behavior with it off as with it on.
So my questions are:
Could some other machine possibly be filtering port 21 traffic before it gets to my machine? (There is also a web server on this machine that I can connect to just fine). If so, how might I go about determining that?
Is there some other thing that I can check to debug this issue?
Any and all help are appreciated.