I have been trying to debug this issue for a while now. What we see is that sometimes, only sometimes ACTIVE ftp from client get "425 Failed to establish connection" from our vsftpd server. I turned on verbose logs and saw that when vsftpd server is trying to connect back to client for eg: from port 20 -> 50502 on client's machine it just times out. I came accross the following link:

http://kalamazoolinux.org/presentati...conntrack.html

Then I checked /etc/init.d/iptables status and it says firewall is stopped. I did iptables -L and don't see any rules. Do you think it's worth adding ip_conntrack_ftp and some other things that above URL is talking about for tcp/ip connection.

I also ran script that logs netstat output and it looks like it sends SYNC_SENT and then is not able to ESTABLISH connection. Earlier I thought that it could be a PORT issue on client side but sometimes connection is successful on the same port that failed before, so I don't think it's a problem on client's side. I was thinking that may be adding ip_conntrack_ftp would be a good idea.

short answer yes.
it is also good idea to prefer passive ftp on client side software.

After making the change this is how it looks. Is this ok?

iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp spt:ftp-data state RELATED,ESTABLISHED

ip_nat_ftp and ip_contrack_ftp are kernel modules. u must load them:
"modinfo ip_conntrack_ftp" will show u the information about that module.
if u want to see if it is really loaded in kernel list the loaded modules with "lsmod" command.

By the way your iptables won't block anything. Because the default policy is ACCEPT and there is no rule that block anything. So it will allow everything.

best regards.

Is it possible to give a quick description of what ip_nat_ftp does? I read about ip_conntrack_ftp that for active ftp sessions it keeps track of incoming acks and correlates with the correct connection.

Also, would you know why ftp would work most of the times and sometimes I would see "425 failed to establish connection" error. And when I look at my netstat output from my script I see SYN_SENT but no ESTABLISH for that port.

Actually these modules were written for firewalls not ftp servers. It can be client side problem. Do u know if client softwares use passive mode?

Edit: is your ftp server behind a firewall?
best regards

Client's use Active connection. So you think that by adding ip_conntrack_ftp will not help?

So I looked at the tcpdump and it looks like that SYN_SENT is sent but then there is no ACK back? When I look at the tcpdump does that show me those packets already processed by iptables or is it before iptables even receive them?