I setup iptables firewall to "trust" port 21 and I am able to ftp to the server. However, when I tried to download and upload files. It showed this message:

227 Entering Passive Mode (192.168.0.5,124,89)
ftp: connect: No route to host

It works fine if I shutdown iptables. How am I going to setup iptables to make my FTP works?

Thanks

Hi,

you are right that you "trust" on port 21 for ftp . so you can login in to the server. but when ftp transfer data then it use diffrent ports other then 21 so you also have to configure that port to transfer your files ( upload or download ) with the help of ftp.


you can use "ftp-data" as protocol name

so allow ftp-data in firewall


bye

which ftp program are you using?

vsftpd v 2.x

please don't drag up dead threads. it is often very confusing for others who think the question is still relevant.

Hi,
Can you display your iptables rule for your FTP ?

No he can't, he posted that 8 years ago.

Oh.. i was not read the datetime he posted..

Edit, just like bipul4b said basically.

Well your half way there but if you didn't open port 20 you'll never get there. Are you currently forwarding 20 to something else? That would explain the ICMP no route message you revive back.

you may also want to add this to your /etc/hosts.allow

ftpd : ALL : allow


Differences from HTTP
FTP operates on the application layer of the OSI model, and is used to transfer files using TCP/IP. To do so, an FTP server has to be running and waiting for incoming requests. The client computer is then able to communicate with the server on port 21. This connection, called the control connection, remains open for the duration of the session. A second connection, called the data connection,can either be opened by the server from its port 20 to a negotiated client port (active mode), or by the client from an arbitrary port to a negotiated server port (passive mode) as required to transfer file data. The control connection is used for session administration, for example commands, identification and passwords exchanged between the client and the server using a telnet-like protocol. For example "RETR filename" would transfer the specified file from the server to the client. Due to this two-port structure, FTP is considered an out-of-band protocol, as opposed to an in-band protocol such as HTTP.

OH good grief, read my replies, you're just wasting your time.