Cannot retrieve directory listing from vsftpd after enabling TLS

Question

I set up vsftpd on an Ubuntu 16.04 server. I added a user, and gave him FTP access via a userlist and chrooted him to his home directory. It worked fine. To make the file transfer more secure I wanted to add a TLS connection.

I created a new certificate with OpenSSL:

sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/vsftpd.pem -out /etc/ssl/private/vsftpd.pem

and adapted my vsftpd.conf:

ssl_enable=YES
rsa_cert_file=/etc/ssl/private/vsftpd.pem
rsa_private_key_file=/etc/ssl/private/vsftpd.pem
force_local_data_ssl=YES
force_local_logins_ssl=YES
ssl_tlsv1=YES
ssl_sslv2=NO
ssl_sslv3=NO
require_ssl_reuse=NO
ssl_ciphers=HIGH

After restarting vsftpd and trying to connect via FileZilla or WinSCP I got the prompt to accept the certificate. But both programs do not actually connect me to the server. They "stop" at "retrieve-directory-listing". This is what happens when I try to log in using FileZilla:

Status: Resolving address of **
Status: Connecting to [**]:21...
Status: Connection established, waiting for welcome message...
Status: Initializing TLS...
Status: Verifying certificate...
Status: TLS connection established.
Status: Server does not support non-ASCII characters.
Status: Logged in
Status: Retrieving directory listing...
Command:    PWD
Response:   257 "/" is the current directory
Command:    TYPE I
Response:   200 Switching to Binary mode.
Command:    EPSV
Response:   229 Entering Extended Passive Mode (|||13468|)
Command:    LIST
Error:  Connection timed out after 20 seconds of inactivity
Error:  Failed to retrieve directory listing
Status: Disconnected from server

Answer 1

You didn't open the data connection ports in your firewall.

It may work without the encryption, if the firewall is smart and opens the ports automatically (link to my article) by inspecting the FTP control connection. But when the control connection is encrypted, the firewall cannot inspect it.

The data connection port range is set in your vsftpd.conf by pasv_max_port and pasv_min_port directives.