Comments on: Linux Passive FTP Not Working Problem And Solution

By: Patrice

Patrice — Sun, 11 Dec 2011 18:47:08 +0000

Why to open the port 1024??? Passive connection use port 21 and then a port from 1024 to 65545…

By: Ryan Griggs

Ryan Griggs — Tue, 23 Aug 2011 19:56:22 +0000

In addition to the firewall rules, on CentOS I had to edit /etc/sysconfig/iptables-config to tell it to load the correct modules.

Add the following to the IPTABLES_MODULES line:
“ip_conntrack_netbios_ns ip_conntrack ip_conntrack_ftp”

So your IPTABLES_MODULES line should read:
IPTABLES_MODULES=”ip_conntrack_netbios_ns ip_conntrack ip_conntrack_ftp”

Restart IPTABLES (‘service iptables restart’) and you should see it load the conntrack modules.

All is good!

Ryan

By: Nitin

Nitin — Tue, 05 Jul 2011 05:06:40 +0000

Worked fine. Thanks.

By: Nishi

Nishi — Sun, 06 Mar 2011 23:34:56 +0000

FTP might work great, but what about that rule that says block all else incoming?? I’m now locked out of the server….

By: Victor Henriquez

Victor Henriquez — Thu, 23 Sep 2010 23:03:23 +0000

Excellent Post…My FTP Works great, thanks….

By: Antonio Díaz M.

Antonio Díaz M. — Wed, 23 Dec 2009 17:06:36 +0000

but you are opening ports that allow connections to other applications such as P2P, MSN Messenger, etc…

By: kitt

kitt — Fri, 07 Aug 2009 00:29:16 +0000

Why do you need this “$IPT -A OUTPUT -p tcp –dport 21 -m state –state NEW,ESTABLISHED -j ACCEPT” if you default accept outgoing packets “$IPT -P OUTPUT ACCEPT”

By: arun kumar

arun kumar — Sat, 04 Jul 2009 08:13:49 +0000

hp laserjet printer 1020 not working in linux at local network

By: Bart Calixto

Bart Calixto — Wed, 01 Apr 2009 23:29:43 +0000

Thanks!, looking for hours for a solution.
My problem was fixed right after i typed : modprobe ip_conntrack_ftp

What this means / do ?

Greetings,
Bart.

By: Dalibor Straka

Dalibor Straka — Tue, 03 Feb 2009 14:45:28 +0000

At first glance I thought it is for client not for server ;-)

This is very nice article except that my FW didn’t work right untill I added RELATED here:

$IPT -A INPUT -p tcp –sport 1024: –dport 1024: -m state –state ESTABLISHED,RELATED -j ACCEPT

I guess that nf_conntrack_ftp reads the port in payload for port 21 and then the new tcp packet from 12345 -> 54321 has SIN flag, thus is RELATED to the first connection, but in no way is established.