I am running a Linux server with CPanel, using APF as the firewall (interface).

We are trying to run FTP over SSL (TLS) or otherwise known as FTPS (not SFTP), these are different. SFTP uses SSH port 22, whereas FTPS uses a secure web certificate and ports 989-990 (I believe, and this is the issue at hand).

When we turn the firewall on, we are not able to FTPS successfully. When we stop the firewall, all connections and transfers are successful, leading me to believe (almost positive) that it is a firewall ruleset issue.

We are allowing standard ports such as 21,22,80, etc and others to be open because it is a web/mail/ftp/ssh server, and we have also allowed incoming ports 989-990 to be open for FTPS.

When we do a portscan with NMAP, the ports show up (989-900) in the ports list, but they do not show open, they show closed. Why are they closed if the firewall is allowing these incoming connections?

Thanks,

Eric

How do you "allow" the additional ports for FTPS in APF?

At the comandline as root try:
iptables -I INPUT -p tcp --dport 989:900 -j ACCEPT

Note that in you're above post you listed 2 different port ranges (989-990 and 989-900), but I'm assuming you meant the second one.