Enable passive mode in FTP server with CSF firewall

If you running an FTP server (Pureftp/Proftp) with a CSF firewall (very importantly in VPS or Virtuozzo etc), it is essential to enable passive mode,  because this mode, works best for ftp clients protected by a firewall since the client initiates the connection. If you don’t enable this mode in VPS you might encounter problems like ftp server will be unresponsive or hang.

Along with FTP server running Pure-ftp  or Proftp, just follow the below steps…

I am posting here the README where FTP connection issues is stressed in CSF firewall documentation…

13. A note about FTP Connection Issues ###################################### It is important when using an SPI firewall to ensure FTP client applications are configured to use Passive (PASV) mode connections to the server. On servers running Monolithic kernels (e.g. VPS Virtuozzo/OpenVZ and custom built kernels) ip_conntrack and ip_conntrack_ftp iptables kernel modules may not be available or fully functional. If this happens, FTP passive mode (PASV) won't work. In such circumstances you will have to open a hole in your firewall and configure the FTP server to use that same hole. For example, with pure-ftpd you could add the port range 30000:35000 to TCP_IN and add the following line to /etc/pure-ftpd.conf and then restart pure-ftpd: PassivePortRange 30000 35000 For example, with proftpd you could add the port range 30000:35000 to TCP_IN and add the following line to /etc/proftpd.conf and then restart proftpd: PassivePorts 30000 35000 FTP over SSL/TLS will usually fail when using an SPI firewall. This is because of the way the FTP protocol established a connection between client and server. iptables fails to establish a related connection when using FTP over SSL because the FTP control connection is encrypted and so cannot track the relationship between the connection and the allocation of an ephemeral port. If you need to use FTP over SSL, you will have to open up a passive port block in both csf and your FTP server configuration (see above). Perversely, this makes your firewall less secure, while trying to make FTP connections more secure.

How to enable passive mode?

1. Add Passive Port range 30000-350000 to your Pureftp or Proftp configuration file

(i) Pureftpd

open /etc/pure-ftpd.conf, and this line

PassivePortRange    30000 35000

(ii) ProFTP

Open /etc/proftpd.conf, and add this line

PassivePorts    30000 35000

2.  Open the ports from 30000 – 35000 in your CSF firewall configuration file under TCP_IN

Open /etc/csf/csf.conf

# Allow incoming TCP ports
TCP_IN = "20,21,22,25,53,80,110,30000:35000"

Then restart firewall and ftp server.

service csf restart
service pureftpd restart (or)
service proftpd restart

Once this is done, open your ftp client and try connecting to ftp server. It should be able to work in passive mode.