Linux Passive FTP Not Working Problem And Solution

Q. I’m running GNU/Linux system with FTP server and passive ftp client requests are not working. What can I do to fix this problem under Linux iptables Firewall?

A. An ftp connection also needs a data transfer channel using active or passive session.

Make sure firewall is not blocking your FTP session. If ports are open make sure IPtables is allowing passive ftp. To solve this problem add ip_conntrack_ftp module. Type the following command to load this module:
# modprobe ip_conntrack_ftp

Iptables passive ftp rules

Same iptables firewall script to deal with incoming ftp requests including Active and Passive connections.

#!/bin/bash
# Sample iptables shell script to deal with FTP server issues including
# active and passive FTP connections issues.
IPT=/sbin/iptables
$IPT -F
$IPT -X
$IPT -t nat -F
$IPT -t nat -X
$IPT -t mangle -F
$IPT -t mangle -X
/sbin/modprobe ip_conntrack
/sbin/modprobe ip_conntrack_ftp
 
# Setting default filter policy
$IPT -P INPUT DROP
$IPT -P OUTPUT ACCEPT
 
# Allow FTP connections @ port 21
$IPT -A INPUT  -p tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT
$IPT -A OUTPUT -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
 
# Allow Active FTP Connections
$IPT -A INPUT -p tcp --sport 20 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A OUTPUT -p tcp --dport 20 -m state --state ESTABLISHED -j ACCEPT 
 
# Allow Passive FTP Connections
$IPT -A INPUT -p tcp --sport 1024: --dport 1024:  -m state --state ESTABLISHED -j ACCEPT
$IPT -A OUTPUT -p tcp --sport 1024: --dport 1024:  -m state --state ESTABLISHED,RELATED -j ACCEPT 
 
### Add the rest of rules below ###
 
### log and drop everything else
$IPT -A INPUT -j LOG 
$IPT -A FORWARD -j LOG 
$IPT -A INPUT -j DROP

Posted by: SXI ADMIN

The author is the creator of SXI LLC and a seasoned sysadmin, DevOps engineer, and a trainer for the Linux operating system/Unix shell scripting. Get the latest tutorials on SysAdmin, Linux/Unix and open source topics via RSS/XML feed or weekly email newsletter.