Question

FC3: How to set iptables rules for ftp passive mode

Asked by: Jerryleo

I failed to get ftp work using passive mod on a fc3 box, it always complains "ftp: connect: No route to host". If I turn passive mode OFF, ftp works fine; if I turn off firewall, all works. And on a DOS box, ftp work fine with both of passive and active mod.

I already set IPTABLES_MODULES="ip_nat_ftp ip_conntrack_ftp" in /etc/sysconfig/iptables-config, it stil didn't work.

Is there any missing?

Thanks

Jerry

************************iptables  rules***************************
/sbin/iptables -L -n -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
31561   16M RH-Firewall-1-INPUT  all  --  *      *       0.0.0.0/0            0.0.0.0/0
 
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 RH-Firewall-1-INPUT  all  --  *      *       0.0.0.0/0            0.0.0.0/0
 
Chain OUTPUT (policy ACCEPT 11957 packets, 2213K bytes)
 pkts bytes target     prot opt in     out     source               destination
 
Chain RH-Firewall-1-INPUT (2 references)
 pkts bytes target     prot opt in     out     source               destination
  529  512K ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
   17  1496 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           icmp type 255
    0     0 ACCEPT     esp  --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     ah   --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            224.0.0.251         udp dpt:5353
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:631
13992   14M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:20
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp spt:20
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:21
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp spt:21
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22
17023 1612K REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited
 
 
******************lsmod output**************************
[root@beks-m04 script]# /sbin/lsmod
Module                  Size  Used by
parport_pc             28293  1
lp                     12873  0
parport                40073  2 parport_pc,lp
autofs4                28229  0
i2c_dev                10945  0
i2c_core               21313  1 i2c_dev
sunrpc                164229  1
pcmcia                 28897  2
ip_nat_ftp              3393  0
iptable_nat            22037  1 ip_nat_ftp
ip_conntrack_ftp       73169  1 ip_nat_ftp
ipt_REJECT              5441  1
ipt_state               1857  2
ip_conntrack           41369  4 ip_nat_ftp,iptable_nat,ip_conntrack_ftp,ipt_state
iptable_filter          2881  1
ip_tables              19521  4 iptable_nat,ipt_REJECT,ipt_state,iptable_filter

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:

Select all Open in new window

This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.

Subscribe now for full access to Experts Exchange and get

Instant Access to this Solution

Plus...

30 Day FREE access, no risk, no obligation
Collaborate with the world's top tech experts
Unlimited access to our exclusive solution database
Never be left without tech help again

Subscribe Now

Asked On: 2008-01-09 at 19:32:23ID23071634
Tags: ftp
,; iptables
,; passive
,; mode
Topics: Linux Setup
,; Linux Network Security
,; Linux Networking
Participating Experts: 5
Points: 50
Comments: 25

Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.

"The time we save is the biggest benefit of Experts Exchange to Warner Bros. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange." Mike Kapnisakis, Warner Bros.
"Our team likes having a resource that is more secure than just using Google and most experts using this service really know their stuff. It's nice to look here first versus using Google." Dayna Sellner, Lockheed Martin
"Anytime that I've been stumped with a problem, 9 out of 10 times Experts Exchange has either the accepted solution or an open discussion of the potential solution to the problem." Kenny Red, eBay Inc.

See what Experts Exchange can do for you.

Got a question?

We've got the answer.

Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.

Screenshot of Experts Exchange Knowledgebase

Need individual assistance?

Our experts are ready to help.

If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.

Want to learn from the best?

Read articles from industry experts.

Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.

Working on a long term project?

Store your work and research.

Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.

Access the answers to your technology questions today.

Subscribe Now

30-day free trial. Register in 60 seconds.

What Makes Experts Exchange Unique?

Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Trusted by the world's most respected brands.

image of each brand's logo

Faithfully serving IT professionals since 1996.

Experts Exchange Logo

Try it out and discover for yourself.

Subscribe Now

30-day free trial. Register in 60 seconds.

Free Tech Articles

WARNING: 5 Reasons why you should NEVER fix a computer for free.
It is in our nature to love the puzzle. We are obsessed. The lot of us. We love puzzles. We love the challenge. We thrive on finding the answer. We hate disarray. It bothers us deep in our soul. W...
SCCM OSD Basic troubleshooting
SCCM 2007 OSD is a fantastic way to deploy operating systems, however, like most things SCCM issues can sometimes be difficult to resolve due to the sheer volume of logs to sift through and the dispe...
Migrate Small Business Server 2003 to Exchange 2010 and Windows 2008 R2
This guide is intended to provide step by step instructions on how to migrate from Small Business Server 2003 to Windows 2008 R2 with Exchange 2010. For this migration to work you will need the fo...
Create a Win7 Gadget
This article shows you how to create a simple "Gadget" -- a sort of mini-application supported by Windows 7 and Vista. Gadgets can be dropped anywhere on the desktop to provide instant information, ...
Outlook continually prompting for username and password
There have been a lot of questions recently regarding Outlook prompting for a username and password whilst using Exchange 2007. There are a few reasons why this would happen and I will try to cover t...
Backup Exchange 2010 Information Store using Windows Backup
There seems to be quite a lot of confusion around the ability to backup Exchange 2010 using the built in Windows Backup feature. This stems from the omission of this feature prior to Exchange 2007 s...

Cloud Class Webinars

Avoiding Bugs in Microsoft Access
Alison Balter takes and in-depth look at avoiding bugs in Access. In this webinar you will learn about using the immediate window to debug your applications, invoking the debugger, using breakpoints to troubleshoot, stepping through code, setting the next statement to execute, ...
Top 10 Best New Features in Visio 2010
Scott Helmers gives live demonstrations of the top 10 new features in Visio 2010. This webinar will teach you how to create compelling diagrams by adding shapes to the page with a single click, linking the shapes in a diagram to data in Excel (or SQL Server, or SharePoint), ...
IT Consultant Business Secrets Revealed
Michael Munger, Experts Exchange tech pro and IT consultant, pulls back the curtain on his very successful businesses and answers question on every IT consultant and business owner should know about. He shares secrets on what he did to solve the 5 most common problems in IT, ...
Disaster Recovery and Business Continuity
Quest CTO, Mike Billon, gives an overview of the steps involved in building a dunamic disaster recovery plan. Through case studies and an examination of software/hardware tooles for monitoring and testing, you'll gain a better understandin of where you are, where you want ...
Organize Your Visio Diagrams with Containers and Lists
Scott Helmers uses cross functional flowcharts, wireframe diagrams, data graphic legends and seating charts to teach you: how to ustilize all three new structured diagram components in Visio 2010, the best practices for organizeing shapes in previous version of Visio, how to organize ...
How to Us Objects, Properties, Events and Methods in Microsoft Access
Alison Dalter gives an in-depbth look at objects, properties, events and methods in Microsoft Access. In this webinar you will learn about using the object browser, referring to objects, working with properties and methods, working with object variables, understanding the ...

Watch More

Join the Community

Give a Little. Get a Lot.

Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.

Join the Community

Answers

by: egaistekPosted on 2008-01-09 at 20:04:05ID: 20624847

try:
sudo su
echo 1 > /proc/sys/net/ipv4/ip_forward

by: JerryleoPosted on 2008-01-09 at 20:26:20ID: 20624934

Thanks for reply

I did it, and restarted both of network and iptables. But I still got the same complains.

by: amirs80Posted on 2008-01-10 at 04:07:42ID: 20626513

ok don't worry and do this
#setup
select Firewall Configuration
select Run tools
select Firewall enable and then select customize
select FTP
select ok
run the command
#/etc/init.d/iptables restart
now check it

by: JerryleoPosted on 2008-01-10 at 04:43:39ID: 20626664

I'm sorry, now only active mode works. Passive mode doesn't works no matter firewall enabled or not.

by: diepesPosted on 2008-01-10 at 14:01:03ID: 20631774

1. Are you trying to ftp from the box that runs the fw ?
2. Are you trying to ftp to the box that runs the fw ?
or
3. Are you trying to ftp through the box that runs the fw, from a host to a server.

by: amirs80Posted on 2008-01-10 at 20:25:06ID: 20634172

from which OS u r trying to access the ftp server

by: ahoffmannPosted on 2008-01-15 at 00:31:14ID: 20660919

#
iptables -A FORWARD -p tcp --sport 1024: --dport 20:21 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A FORWARD -p tcp --sport 20:21 --dport 1024: -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -p tcp --sport 1024: --dport 1024: -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -p tcp --sport 1024: --dport 1024: -m state --state RELATED,ESTABLISHED -j ACCEPT

# and/or
iptables -A INPUT -p tcp --sport 1024: --dport 20:21 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 20:21 --dport 1024: -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp --sport 1024: --dport 1024: -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 1024: --dport 1024: -m state --state RELATED,ESTABLISHED -j ACCEPT

by: RedimidoPosted on 2008-01-15 at 09:47:05ID: 20664661

I usually have

iptables -P OUTPUT -j ACCEPT

and in the input rules
iptables -A INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 21 -j ACCEPT

and it works passive or active.

you do not need forward unless you are DNATing to an internal ftp server.

by: JerryleoPosted on 2008-01-15 at 20:41:30ID: 20669275

Thanks for all reply.

>1. Are you trying to ftp from the box that runs the fw ?
Yes. I'm on a fc3 box. But I can't disable the fw

>2. Are you trying to ftp to the box that runs the fw ?
Yes. It's Red Hat Enterprise Linux AS release 3 (Taroon Update 8) with iptables enabled, I don't have root right on that box. And the ftp server is vsFTPd 1.2.1

My situation is

Both of fc3 box and the ftp server are in the LAN but on the different network segment.
I have tried all above methods, none of them worked.
I disabled the fw on my box, but it still failed to let passive work.
I ftp from WINDOWS XP box, both of active and passive mode work fine.
Route table infomation posted on Code Snippet.

any ideas?

Here are route table infomation on my fc3 box
 
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.14.9.0       *               255.255.255.0   U     0      0        0 eth0
169.254.0.0     *               255.255.0.0     U     0      0        0 eth0
default         10.14.9.1       0.0.0.0         UG    0      0        0 eth0

1:
2:
3:
4:
5:
6:
7:

Select all Open in new window

by: RedimidoPosted on 2008-01-16 at 12:39:49ID: 20675839

so you were moving the firewall ON THE CLIENT :-)

we were thinking on the SERVER firewall.

if you can ftp from windows and from linux no, then it can be because of the ports are limited to a range.

I do this when I need to limit ports used by mi programs on the client:

# Add this to your rc.local so it is run at each startup:
echo 1024 32768 > /proc/sys/net/ipv4/ip_local_port_range
echo 1024 > /proc/sys/net/ipv4/tcp_max_syn_backlog

This way new tcp connections will work like in a windows machine (cuting by half the max number of connections you can have at any tine, from 64K to 32K, which is A LOT specially for a client machine)

Once you do that (again, on the client), try to reconnect to the server and use passive mode to see if it works.

Regards

by: JerryleoPosted on 2008-01-18 at 06:59:08ID: 20690715

I'm sorry. It' still didn't work. Should I do it on both of server side and client side? I just do it on client side. I don't have root right on server side.

by: ahoffmannPosted on 2008-01-18 at 10:04:54ID: 20692629

> I don't have root right on server side
then you're not doing any changes on the server, in particular the firewall, do you?
Hence you first need to ensure that your server allows ftp as you need it.

by: diepesPosted on 2008-01-18 at 13:41:17ID: 20694450

When you ftp what is the error you get ?
A. Timeout ?
B. Password prompt ? If you get this far port 21 is open, the controll connection.
You can verify with #telnet ip_rh 21
And see if you can connect.
C. If you enter password and cant transfer files then it could be the data connection that does not open port 20.

by: JerryleoPosted on 2008-01-18 at 19:21:32ID: 20695951

I can logon the ftp server. While I use ls to get the list, it showed ""227 Entering Passive Mode (10,36,6,44,180,141) ftp: connect: No route to host". I have to turn off passive mode, then I can get the list and transfer files. I disabled the firewall, the issue still exist.

Here are a post I found

# firewall
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
modprobe ip_conntrack
modprobe ip_conntrack_ftp

# Setting default filter policy
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
# Rest of rules

I did it following above steps. It drops my network connection. I have to disable the iptables and restart networking.

by: RedimidoPosted on 2008-01-18 at 19:39:02ID: 20695980

let me ask

is the other ftp server on 10.36.6.44 ? because if not, you will not be able to connect using passive mode unless you setup the ftp server to be behind a firewall

by: JerryleoPosted on 2008-01-18 at 22:49:11ID: 20696444

The situation is

1. server is on 10.36.6.44
2. I'm on 10.14.9.23. I can access the server under both linux box and windows box
3. on the windows box, the ftp works fine with both passive and active mode
4. on the linux box, the ftp only works with active mode, even I disabled the firewall of the linux box.
5. I did all of above methods, none of them works for me.

I think it maybe some default rules just like under proc/sys/net/ipv4 or something like it stop me, but I don't know. It's very strange that all the methods found on the Internet didn't work for me. I just want to know the reason.

by: RedimidoPosted on 2008-01-19 at 12:48:51ID: 20698875

what ftp client are you using?

if you are using ftp, please try with pftp -or-more advanced console clients like ncftp or lftp (I think ncftp is the best console ftp client), for graphic ftp clients there is FileZilla or gftp.

would you mind to try with these? client firewall turned off please.

by: diepesPosted on 2008-01-19 at 13:14:41ID: 20699039

Is the windows box you tested from also in the 10.36.6.xx subnet ?

by: JerryleoPosted on 2008-01-19 at 17:29:26ID: 20699734

>Is the windows box you tested from also in the 10.36.6.xx subnet ?
No. I use dual OS, the windows box in 10.14.9.x

>would you mind to try with these? client firewall turned off please.
I use the fc3 native ftp client. I tried ncftp, the same result , the passive mode sitll failed, but it switched to active mode automaticly

Connecting to 10.36.6.44...
(vsFTPd 1.2.1)
Logging in...
Login successful.
Logged in to 10.36.6.44.
ncftp / > dir
connect failed: No route to host.
Falling back to PORT instead of PASV mode.
drwxr-xr-x 2 0 0 4096 Feb 24 2006 pub

gftp also showed "227 Entering Passive Mode (10,36,6,44,150,101) Cannot create a data connection: No route to host"

by: diepesPosted on 2008-01-20 at 00:37:37ID: 20700526

I does not make sense to me.

Your ftp connects on port 21, and you log in.
Then when it tries to open the passive mode connection to the same server you get "No route to host"
I does sound like a firewall or acl is only allowing port 21 through outbound.

Can you open a 2nd console and do a packet trace.
1. When you do the dir/ls see if there is packets leaving your host to the server.
2. Check for any ICMP traffic from routers or remote server.

I assume your lan connection is on eth0
# tcpdump -i eth0 -f "host 10.36.6.44 or proto \icmp"

by: JerryleoPosted on 2008-01-20 at 00:58:14ID: 20700554

Here are the output

[root@beks-m04 jerry]# /usr/sbin/tcpdump -i eth0 -f "host 10.36.6.44 or proto \icmp"
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
16:57:11.897450 IP 10.14.9.23.37143 > 10.36.6.44.ftp: S 3987484028:3987484028(0) win 5840 <mss 1460,sackOK,timestamp 27900156 0,nop,wscale 2>
16:57:11.929742 IP 10.36.6.44.ftp > 10.14.9.23.37143: S 3608314924:3608314924(0) ack 3987484029 win 5792 <mss 1460,sackOK,timestamp 546773206 27900156,nop,wscale 0>
16:57:11.929784 IP 10.14.9.23.37143 > 10.36.6.44.ftp: . ack 1 win 1460 <nop,nop,timestamp 27900157 546773206>
16:57:11.929809 IP 10.36.6.44.ftp > 10.14.9.23.37143: P 1:21(20) ack 1 win 5792 <nop,nop,timestamp 546773207 27900157>
16:57:11.929835 IP 10.14.9.23.37143 > 10.36.6.44.ftp: . ack 21 win 1460 <nop,nop,timestamp 27900159 546773207>
16:57:11.898055 IP 10.14.9.23.37143 > 10.36.6.44.ftp: P 1:14(13) ack 21 win 1460 <nop,nop,timestamp 27900187 546773207>
16:57:11.898391 IP 10.36.6.44.ftp > 10.14.9.23.37143: . ack 14 win 5792 <nop,nop,timestamp 546773209 27900187>
16:57:11.898470 IP 10.36.6.44.ftp > 10.14.9.23.37143: P 21:59(38) ack 14 win 5792 <nop,nop,timestamp 546773209 27900187>
16:57:11.898579 IP 10.14.9.23.37143 > 10.36.6.44.ftp: P 14:32(18) ack 59 win 1460 <nop,nop,timestamp 27900187 546773209>
16:57:11.898953 IP 10.36.6.44.ftp > 10.14.9.23.37143: P 59:97(38) ack 32 win 5792 <nop,nop,timestamp 546773209 27900187>
16:57:11.938716 IP 10.14.9.23.37143 > 10.36.6.44.ftp: . ack 97 win 1460 <nop,nop,timestamp 27900228 546773209>
16:57:13.780708 IP 10.14.9.23.37143 > 10.36.6.44.ftp: P 32:44(12) ack 97 win 1460 <nop,nop,timestamp 27902070 546773209>
16:57:13.781131 IP 10.36.6.44.ftp > 10.14.9.23.37143: P 97:131(34) ack 44 win 5792 <nop,nop,timestamp 546773398 27902070>
16:57:13.813390 IP 10.14.9.23.37143 > 10.36.6.44.ftp: . ack 131 win 1460 <nop,nop,timestamp 27902102 546773398>
16:57:14.666791 IP 10.14.9.23.37143 > 10.36.6.44.ftp: P 44:56(12) ack 131 win 1460 <nop,nop,timestamp 27902956 546773398>
16:57:14.672418 IP 10.36.6.44.ftp > 10.14.9.23.37143: P 131:154(23) ack 56 win 5792 <nop,nop,timestamp 546773487 27902956>
16:57:14.694345 IP 10.14.9.23.37143 > 10.36.6.44.ftp: . ack 154 win 1460 <nop,nop,timestamp 27902984 546773487>
16:57:14.694389 IP 10.14.9.23.37143 > 10.36.6.44.ftp: P 56:62(6) ack 154 win 1460 <nop,nop,timestamp 27902984 546773487>
16:57:14.694753 IP 10.36.6.44.ftp > 10.14.9.23.37143: P 154:173(19) ack 62 win 5792 <nop,nop,timestamp 546773489 27902984>
16:57:14.748289 IP 10.14.9.23.37143 > 10.36.6.44.ftp: . ack 173 win 1460 <nop,nop,timestamp 27903038 546773489>
16:57:16.245446 IP 10.14.9.23.37143 > 10.36.6.44.ftp: P 62:68(6) ack 173 win 1460 <nop,nop,timestamp 27904535 546773489>
16:57:16.245967 IP 10.36.6.44.ftp > 10.14.9.23.37143: P 173:220(47) ack 68 win 5792 <nop,nop,timestamp 546773644 27904535>
16:57:16.246029 IP 10.14.9.23.37143 > 10.36.6.44.ftp: . ack 220 win 1460 <nop,nop,timestamp 27904535 546773644>
16:57:16.246153 IP 10.14.9.23.53120 > 10.36.6.44.36679: S 4007317256:4007317256(0) win 5840 <mss 1460,sackOK,timestamp 27904536 0,nop,wscale 2>
16:57:16.246548 IP 10.36.6.44 > 10.14.9.23: icmp 68: host 10.36.6.44 unreachable - admin prohibited

by: diepesPosted on 2008-01-20 at 06:40:41ID: 20701208

Ok the last 2 packets gives us a clue.

A. >> 6:57:16.246153 IP 10.14.9.23.53120 > 10.36.6.44.36679: S 4007317256:4007317256(0) win 5840 <mss 1460,sackOK,timestamp 27904536 0,nop,wscale 2>
this looks like the first packet of the passive data connection from port 53120 on your linux box to port 36679 on the ftp server (10.36.6.44)

B >> 16:57:16.246548 IP 10.36.6.44 > 10.14.9.23: icmp 68: host 10.36.6.44 unreachable - admin prohibited
Here the server(10.36.6.44) send a ""admin prohibited"" icmp back, saying i am not allowing this connection.

This problem seem to be a firewall on the ftp server blocking the data connection of the ftp.

by: JerryleoPosted on 2008-01-20 at 17:07:45ID: 20703261

Thank you for your comments.

But why the ftp server didn't block the data connection of the windows box ftp? On windows box, the ftp works for active and passive mode fine.

by: RedimidoPosted on 2008-01-20 at 23:52:38ID: 20704446

16:57:16.246153 IP 10.14.9.23.53120 > 10.36.6.44.36679: S 4007317256:4007317256(0) win 5840 <mss 1460,sackOK,timestamp 27904536 0,nop,wscale 2>

it can be of little clue but see this:
16:57:16.246153
10.36.6.44.36679

I see the high ports going over 32767. maybe the server has a restriction on which ports it allow for passive ftp.

could you configure your client to use, say passive ports between 5000 and 6000 ?
check which ports (on the server) vsftpd has activated:
cat /etc/vsftpd/vsftpd.conf | grep pasv

also try to connect from the same server and use passive mode so you know this is issue is in the firewall or in the vsftp itself:
SERVER $ ftp localhost
(issue pasv command and try to dir)

by: JerryleoPosted on 2008-01-23 at 04:00:42ID: 20722583

to Redimido

Thank you for your comments.

I failed to check /etc/vsftpd/vsftpd.conf on the server, because I don't have root rights.

I tried ftp from server localy, active and passive mode work fine.

Anyway, I got the clue.

thanks for everyone and your time for comments

20120131-EE-VQP-002

3 Ways to Join

30-Day Free Trial

For individual users
Instant access to solutions
Ask your tech questions
Start your 30-day Free Trial

Business Accounts

Perfect for organizations
Multiple users
Save over 36%
Create a Business Account

Answer for Membership

Earn free access
Showcase your knowledge
No credit card required
Sign Up to Answer

The Experts

98% positive feedback on 31,087 answers since March 2000. angeliii is a Microsoft Most Valuable Professional for his work with MS SQL Server & Develoment.

He has also proven his knowledge of Visual Basic Programming, PHP Scripting and Oracle Databases.

The Experts

97% positive feedback on 10,752 answers since July 2000. lrmoore has more than 18 years experience in the networking industry.

The six-time Mircosoft MVPs specialties include firewalls, virtual private networking, and network management.

Testimonials

"...and excellent source for support... Kind of like having your very own IT dept." Electriciansnet

Testimonials

"I was apprehensive at signing up at first. However... it has already made my life as an IT administrator much easier." JaCrews

Testimonials

"WOW! You guys have great, active, and knowledgeable people on here." moore50

Business Clients

In the Press

"If you’ve got a question... Experts Exchange can supply an answer.”

In the Press

"...an invaluable aid for both IT professionals and those who require tech support."

In the Press

"where IT professionals provide quick answers on just about any topic"

Business Account Plans

Loading Advertisement...

Question

FC3: How to set iptables rules for ftp passive mode

Subscribe now for full access to Experts Exchange and get

Instant Access to this Solution

ftp

iptables

passive

mode

Linux Setup

Linux Network Security

Linux Networking

Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.

See what Experts Exchange can do for you.

Got a question?

We've got the answer.

Need individual assistance?

Our experts are ready to help.

Want to learn from the best?

Read articles from industry experts.

Working on a long term project?

Store your work and research.

What Makes Experts Exchange Unique?

Trusted by the world's most respected brands.

Faithfully serving IT professionals since 1996.

Related Solutions

Free Tech Articles

Cloud Class Webinars

Join the Community

Give a Little. Get a Lot.

Answers

3 Ways to Join

The Experts

The Experts

Testimonials

Testimonials

Testimonials

Business Clients

Business Clients

In the Press

In the Press

In the Press