I'm trying to add ftp service to firewalld, and every time I run firewall-cmd --add-service=ftp (this is with out the permanent flag) I get Error: COMMAND_FAILED.
If I run firewall-cmd --permanent --add-service=ftp (this is with the permanent flag), it returns success.

However after I reload the service I can't connect via ssh until I disable firewalld over rescue mode.

I'm not trying to open ssh's port. I'm just stating that I lose access to the server after running firewall-cmd --permanent --add-service=ftp and then reload with firewall-cmd --reload.

  • What makes you think --add-service=ftp for port 21 would open port 22 used by SSH? – Esa Jokinen Jun 11 '17 at 10:20
  • that's not at all what im trying to do, im saying after i run firewall-cmd --permanent --add-service=ftp and reload firewalld i get locked out of ssh – ben Jun 11 '17 at 14:32
  • and if i run the command without the --permanent flag i get Error: COMMAND_FAILED any time i try to add a service to firewalld i was using ftp as an example – ben Jun 11 '17 at 14:39

Indeed this happens with grs kernel on Centos 7. Actually, your question includes the answer. In order to eliminate the problem you need to avoid using the command firewall-cmd --permanent --zone=public --add-service=ftp when opening firewalld ports, or remove it if it is already there with firewall-cmd --permanent --remove-service=ftp. This solves the issue!

You can use the command firewall-cmd --permanent --zone=public --add-port=21/tcp though, so you can have port 21 open if you want.

The explanation is that firewalld tries to load the nf_conntrack_ftp kernel module, even when module support is disabled, and in grs kernel this module is disabled indeed.

I can guess that even if you don't use a grs kernel, you have the nf_conntrack_ftp kernel module disabled. If you reverse this reasoning, you could enable this module, but I am not sure if you can, and I have not tried this solution that looks obvious to me.

This also solves the problem of being locked out after firewall-cmd --reload when service=ftp is added in firewalld, which in fact is the problem I had with the grs kernel.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.