Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have pure-ftpd running on web server with Fail2Ban. Fail2Ban is letting apache2 connections in but are denying any FTP connection from anything but local host. I have attempted to modify the jail.local and jail.conf files but I am still having issues.

Here is the pure-ftpd section of my jail.local file:

enabled = true
port     = ftp,ftp-data,ftps,ftps-data
filter   = pure-ftpd
logpath  = /var/log/auth.log
maxretry = 6

Here is a view of my iptables -L -n:

Chain INPUT (policy DROP)
target     prot opt source               destination
fail2ban-postfix  tcp  --              multiport dports 80,443,25,587,110,995,143,993,4190
fail2ban-dovecot  tcp  --              multiport dports 80,443,25,587,110,995,143,993,4190
fail2ban-roundcube  tcp  --              multiport dports 80,443,25,587,110,995,143,993,4190
fail2ban-ssh  tcp  --              tcp dpt:22
fail2ban-pure-ftpd  tcp  --              multiport dports 21,20,990,989
ACCEPT     all  --              state RELATED,ESTABLISHED
ACCEPT     all  --  
ACCEPT     tcp  --              tcp dpt:80
ACCEPT     tcp  --              tcp dpt:443
ACCEPT     tcp  --              tcp dpt:25
ACCEPT     tcp  --              tcp dpt:587
ACCEPT     tcp  --              tcp dpt:110
ACCEPT     tcp  --              tcp dpt:995
ACCEPT     tcp  --              tcp dpt:143
ACCEPT     tcp  --              tcp dpt:993
ACCEPT     tcp  --              tcp dpt:22
ACCEPT     icmp --              icmptype 8

Chain FORWARD (policy DROP)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain fail2ban-dovecot (1 references)

If I run the following commands manually FTP works (as active, still can't get passive to work), but I really want to get this working with Fail2Ban:

iptables -A INPUT -p tcp --dport 21 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 20 -j ACCEPT

Any ideas on how to get the fail2ban to configure iptables correctly? If not, what rules do I need to set to get active and passive FTP working correctly?

share|improve this question
You sort of have 2 issues, first with ftp and second with fail2ban. First, for ftp, I suggest you see… – bodhi.zazen Feb 18 '14 at 17:28
For fail2ban, personally I do not like this as IMO it is unnecessary. It installs additional packages and results in additional vulnerabilities (either bugs in fail2ban or dos). IMO best to use iptables directly. See the "Use iptables to reject/block failed connections" section here - – bodhi.zazen Feb 18 '14 at 17:31
I am fairly new to iptables - I am on Ubuntu 12.04.4 server and I do not have a /etc/sysconfig/iptables-config. Where is the config file located, I have tried a find / -name iptables-config and nothing was found. – QuantumPhysGuy Feb 19 '14 at 18:37
I found it at /etc/default/iptables and I just added -A INPUT -p tcp --dport 20 -j ACCEPT -A INPUT -p tcp --dport 21 -j ACCEPT and it worked. – QuantumPhysGuy Feb 19 '14 at 18:56

I found the default IPTABLES configuration at /etc/default/iptables and added the following and restarted the iptables service and ftp is now working:

-A INPUT -p tcp --dport 20 -j ACCEPT
-A INPUT -p tcp --dport 21 -j ACCEPT
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.