How to set firewall rules on a client machine that needs to access FTP and SFTP servers?

The default policy on client's machine is to deny all connections (incoming and outgoing)

there are (UFW) rules that allow:

20/tcp                     ALLOW OUT   Anywhere  # FTP Data
21/tcp                     ALLOW OUT   Anywhere  # FTP Command
22                         ALLOW OUT   Anywhere  # SSH, SFTP
990                        ALLOW OUT   Anywhere  # FTPS
989                        ALLOW OUT   Anywhere  # FTPS

that work well on client machine for the connection to FTP/FTPS, and authenticating there but when the ftp client requests directory tree listing an error occurs:

Error: Failed to retrieve directory listing

Connection log:

Status: Resolving address of xxx.xxx.xxx.xxx
Status: Connecting to 1xx.1xx.2xx.1xx:21...
Status: Connection established, waiting for welcome message...
Status: Initializing TLS...
Status: Verifying certificate...
Status: TLS connection established.
Status: Logged in
Status: Retrieving directory listing...
Command:  PWD
Response:  257 "/" is your current location
Command:  TYPE I
Response:  200 TYPE is now 8-bit binary
Command:  PASV
Response: 227 Entering Passive Mode (1xx,1xx,2xx,1xx,1xx,2xx)
Command:  MLSD
Error:  Connection timed out after 20 seconds of inactivity
Error:  Failed to retrieve directory listing

If the firewall is turned off there is no error so the problem is related to the firewall configuration.

What needs to be added as rule (preferably as UFW rule) in order to have firewall active with default disallow rule but allowing FTP and SFTP connections?

  • 1
    have the client use 'active' mode instead of 'passive' mode. Passive mode needs you to unlock a TON of high number ports in both directions because it uses high-numbered ephemeral ports among other things (you basically have to permit 1024-65535 and that can be problematic if you're operating in a restricted environment)
    – Thomas Ward
    Feb 25 '19 at 15:23
  • @ThomasWard tried with active but didn't work. Got the log: Response: 500 I won't open a connection to: 10.xx.xxx.xxx
    – Jimmix
    Feb 25 '19 at 15:28
  • @ThomasWard 'high-numbered ephemeral ports' I think there was a kind of securing this with a stateful firewall configuration or sort of IP tables config that somehow treated a particular ephemeral port as a part of (S)FTP connection and only for the time of the (S)FTP session allowed that ephemeral port to be used to connecti In/Out to particular IP. But don't know how to configure either of the solutions.
    – Jimmix
    Feb 25 '19 at 15:35
  • Right but you still need to allow the traffic outbound to create the connection- stateful just means it'll keep the connection but you still need to connect before you get a state to track.
    – Thomas Ward
    Feb 25 '19 at 15:40
  • @ThomasWard can you limit access to ephemeral ports to only one process - (S)FTP client?
    – Jimmix
    Feb 25 '19 at 16:19

In /etc/proftpd/proftpd.conf

Unmark: PassivePorts 65000 66000 (choose a span of passive ports)

In ufw open the span of ports

sudo ufw allow 65000:66000/tcp
  • I had already allowed the ports in ufw, just needed to uncomment PassivePorts in the config
    – Jacksonkr
    Aug 5 '20 at 21:28
  • Remove # in "# PassivePorts 65000 66000" it will look like "PassivePorts 65000 66000", please use your own range of number.
    – Raberg
    Sep 13 '20 at 15:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.