Resolve Passive FTP Data Port Problems

Configure Passive FTP Server with VSFTP

Firewalls attempting to protect their workstation clients behind them make it nearly impossible to use active FTP for transferring files because the firewall will not allow the server to initiate the data port to the client.  Typically, the connection will default to passive ftp to transfer the files.  Passive FTP has the benefit of allowing the client to initiate all of the connections which allows it work better through firewalls.  Typically, Passive FTP resolves the problem, but sometimes it doesn’t.  In these cases, it can require some configuration to get it working properly.  Our example today is using vsftp, which you can easily install (yum install vsftpd) and will help you resolve passive FTP data port problems

How to Determine if You Have a Problem with the FTP Data Port

To determine if you have a problem with ftp due to the data port, you can find out easily by logging in to ftp and using the “ls” command.  If the command hangs and doesn’t return, you can be sure that you have a problem with the ftp data port.  This symptom is characterized by the command port working while the data port does not.

Why Does FTP Hangs on LS!

In the example above, the “ls” command times out and never returns because the passive ftp data port doesn’t connect.  Luckily, we can fix the passive ftp data port problem pretty easily.

Defining a Passive FTP Port Range

All ftp configuration in vsftp is done in the /etc/vsftpd/vsftpd.conf.  We can define the passive data port by setting the range using the pasv_min_port and pasv_max_port by adding the following lines to the file and setting the high port values that we want to use for the upper and lower boundaries:

Additionally, you will want to enable the “ip_conntrack_ftp” module in your ftp server’s iptables configuration.  You can enbale ip_conntrack_ftp by editing the /etc/sysconfig/iptables-config file:

Now, restart the iptables and vsftpd services:

That should resolve the problem.  Let’s try to execute the “ls” command again:

The “ls” command worked this time and the listing returned without issue.  Problem solved!

The following two tabs change content below.

• Bio
• Latest Posts

Jeff Staten

Jeff has 20 years of professional IT experience, having done nearly everything in his roles of IT consultant, Systems Integrator, Systems Engineer, CNOC Engineer, Systems Administrator, Network Systems Administrator, and IT Director. If there is one thing he knows for sure, it is that there is always a simple answer to every IT problem and that downtime begins with complexity. Seasoned IT professional by day, Jeff hopes to help other IT professionals by blogging about his experiences at night on his blog: http://uptimemadeeasy.com. You can find Jeff on Google+ or LinkedIn at: LinkedIn or Twitter at: Twitter

Latest posts by Jeff Staten (see all)

• Configure Your HP Procurve Switch with SNTP - May 5, 2015
• Configuring HP Procurve 2920 Switches - May 1, 2015
• Troubleshooting Sendmail - November 28, 2014

Related posts:

Sshd Allow Login by Time Schedule Add a Disk to a Linux System Using LVM Install, Update, Remove, and Automate Yum Package Management Linux Process Monitoring: Things You Likely Didn’t Know About Top