Member Avatar for Venom Rush

Hi guys/gals

I'm having the most frustrating time trying to connect to FTP servers in order to upload files. I try to connect to a number of different FTP servers and cannot connect to any of them.

I've tried connecting to the same servers using the same FTP programs on a second machine and it has no issues at all.

I've done ping and tracert tests on the machine with the issues and the internet connection is definitely NOT the problem. I've looked at network settings but with my little knowledge about networks I've not been able to see if there are any issues. Both PCs have the same network setup so I doubt it's a network issue.

I'm at a loss, anyone come across a similar issue?

  • 3 Contributors
  • 3 Replies
  • 394 Views
  • 2 Months Discussion Span
  • Latest Post Latest Post by landonmkelsey

Dani AI

Generated

Quick summary and context: solved the immediate problem when the host firewall started dropping FTP control connections, and was correct to point at host-level filtering. FTP is a two‑channel protocol (control on TCP/21, plus separate data connections) so blocking the control port or failing to allow the negotiated data ports will make every FTP client hang or fail. Properly restricting and opening a passive port range (or allowing the FTP/NAT helpers) is the usual long‑term fix. (mirror.math.princeton.edu)

When only one PC on a LAN cannot talk to any FTP servers while others can, the likely culprits are: a host firewall/egress filter, a misconfigured NAT helper, or SELinux/AppArmor policy on that host. Linux’s Netfilter has FTP “helpers” (nf_conntrack_ftp / nf_nat_ftp) that let the kernel translate PASV/PORT negotiation into RELATED connections so firewalls can automatically allow the data channel — without them the data ports look like unrelated connections and get dropped. Checking/loading those helpers is often the missing step. (shorewall.org)

Practical checks (run on the failing machine):

# any listener on 21?
ss -tlnp | grep ':21'

# can the control port be reached?
nc -vz ftp.example.com 21
nmap -p21 ftp.example.com

# capture what actually happens on the wire
sudo tcpdump -i any 'port 21 or portrange 1024-65535' -c 100 -w ftp.pcap

# check firewall backend (nftables / firewalld / ufw)
sudo nft list ruleset
sudo firewall-cmd --list-all
sudo ufw status

Capturing traffic (tcpdump) helps see whether packets leave and whether replies return. (cordero.me)

About SELinux and vsftpd: rather than disabling SELinux (as hinted), inspect AVC denials and enable only the needed booleans (ftpd_anon_write, ftpd_full_access, etc.) or create a narrow policy with audit2allow. Use ausearch/aureport/sealert to find denials and getsebool/setsebool for persistent changes. (docs.redhat.com)

If security and reliability matter, prefer SFTP (SSH‑based) over plain FTP — single port, encrypted, and much easier to run through firewalls. (ssh.com)

Recommended Answers

All 3 Replies

Member Avatar for sknake

You may have outbound FTP filtered. type iptables-save as root on the command prompt and paste the data back here.

Also are the two machines you tested on the same LAN? IE
= router
= broken machine
= working machine

And you have confirmed they are using the same default gateway? Paste the output of route -n in linux to get the gateway. In windows type route print .

Also on the nonworking linux machine paste the output of: telnet ftp.kernel.org 21 It should look like this:

root@svn:~/devex# telnet ftp.kernel.org 21
Trying 149.20.20.133...
Connected to pub.us.kernel.org.
Escape character is '^]'.
220 Welcome to ftp.kernel.org.

But yours doesn't work so it will probably look like:

root@svn:~/devex# telnet ftp.kernel.org 21
Trying 149.20.20.133...
telnet: Unable to connect to remote host: Connection refused

Or after 30 seconds it may never finishing and just sit at the "Connecting...."

The type of error you see will help determine what the problem may be ;)

Member Avatar for Venom Rush

You may have outbound FTP filtered. type iptables-save as root on the command prompt and paste the data back here.

Also are the two machines you tested on the same LAN? IE
= router
= broken machine
= working machine

And you have confirmed they are using the same default gateway? Paste the output of route -n in linux to get the gateway. In windows type route print .

Also on the nonworking linux machine paste the output of: telnet ftp.kernel.org 21 It should look like this:

root@svn:~/devex# telnet ftp.kernel.org 21
Trying 149.20.20.133...
Connected to pub.us.kernel.org.
Escape character is '^]'.
220 Welcome to ftp.kernel.org.

But yours doesn't work so it will probably look like:

root@svn:~/devex# telnet ftp.kernel.org 21
Trying 149.20.20.133...
telnet: Unable to connect to remote host: Connection refused

Or after 30 seconds it may never finishing and just sit at the "Connecting...."

The type of error you see will help determine what the problem may be ;)

Thanks for your reply sknake. I found what my issue was. My firewall went haywire and wasn't letting any connections on port 21 through.

Member Avatar for landonmkelsey

problem solved?? then ignore this!

(1) disable selinux
(2) configure the conf file and log into the machine you are on
[root@localhost etc]# cd /etc/vsftpd
[root@localhost vsftpd]# ls -alF
total 36
drwxr-xr-x 2 root root 4096 2009-11-27 15:29 ./
drwxr-xr-x 146 root root 12288 2010-01-10 11:29 ../
-rw------- 1 root root 125 2009-11-23 07:44 ftpusers
-rw------- 1 root root 361 2009-11-23 07:44 user_list
-rw------- 1 root root 4495 2009-11-23 07:44 vsftpd.conf
-rwxr--r-- 1 root root 338 2009-11-23 07:44 vsftpd_conf_migrate.sh*
[root@localhost vsftpd]#

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.