Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I set up SFTP, but I have a problem regarding iptables. Here are my rules:

A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT
A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 20 -j ACCEPT
A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT

By the way, I'm using the vsftpd service for FTP. So, it's not connecting to FTP, before stopping iptables service. When I attempt to connect to FTP, that's gives me "Listing remote folder failed" error.

What should I do?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

SFTP and FTP are not the same thing.

If you really mean SFTP, that's an SSH-based transmission that takes place only over port 22 (unless you configure your SSH daemon to listen on another port).

FTP is an ancient file-transfer protocol that operates on ports and 21 (and possibly others). Firewalls need to do connection state-tracking to properly support it. Make sure you have the netfilter ftp connection tracking module (nf_conntrack_ftp) loaded.

You can configure the min/max ports for "passive mode" FTP in vsftp via the pasv_min_port and pasv_max_port options in vsftpd.conf: Could you narrow the range down to a small number of ports (perhaps one port) and open them in the firewall?

Are you sure the firewall is at fault? If you disable it temporarily, do things work?

share|improve this answer
    
As you mentioned,if I disable it temporarily,FTP's running. –  Cell-o Jun 22 '11 at 9:31

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.