On 12/22/07, Benoy George <bgenix(a)gmail.com> wrote:
-------- Original Message --------
Subject: [ILUG-BOM] ftp error: 500 invalid port connection
From: Agnello George <agnello.dsouza(a)gmail.com>
To: GNU/Linux Users Group, Mumbai, India <linuxers(a)mm.glug-bom.org>
Date: Friday 14 December 2007 04:58:39 PM IST
I am trying to access a ftp server . I am able to connect to it with the
user name and password. However when i connect to the server and do a dir i
get the following error.
C:\Documents and Settings\Admin>ftp XXX.XXX.XXX.XXX
Connected to XXX.XXX.XXX.XXX
220 Microsoft FTP Service
User (XXX.XX.XXX.XXX:(none)): user-name
331 Password required for user-name
230 User user-name logged in.
500 Invalid PORT Command.
150 Opening ASCII mode data connection for /bin/ls.
I got a fire wall running and i have opened port 21, The entry in the
iptables is as follows .
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 21 -j
why am i getting the error ?? when i am able to ftp to other ftp site with
out authentication ( like ftp://126.96.36.199/pub/ )
Sorry for the late reply, since I am not marking to the list.
From your previous thread I have noticed that you have not
added ftp-data port(20) to the policy.
$cat /etc/services | grep -i ^ftp
on your linux machine.
and try with
But still sometime we are getting errors with ftp service from
Thanks for all the answers but here is what i did
A PORT command is again issued, but this time it is from the server to
the client. The client connects to the server for data transfer. Since
the connection is in the same sense as the original ftp connection,
passive ftp is inherently more secure than active ftp, but note that
this time we know even less about the port numbers. Now we have a
connection between almost arbitrary port numbers.
Enter the ip_conntrack_ftp module once more. Again, this module is
able to recognize the PORT command and pick-out the port number.
Instead of NEW in the state match for the OUTPUT chain, we can use
RELATED. The following rules will suffice:
iptables -A INPUT -p tcp --sport 1024: --dport 1024: -m state
--state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 1024: --dport 1024: -m state
--state ESTABLISHED,RELATED -j ACCEPT
add the following to the kernel
Agnello . G .Dsouza