I am trying to install vsftpd on Centos 7. I can connect to the server from localhost, but not connect to it from remote machines. I am somewhat new to the topic of system and network administration.
Here are some places I've looked for answers:
Can not open ftp port via firewalld
Centos does not open port/s after the rule/s are appended
Port 80 filtered nmap
I have the vsftpd service up and running:
> netstat -plnt | grep ':21. '
tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN 12393/vsftpd
and I can log in using ftp localhost
just fine. But when I attempt a remote login, I get "connection timed out" after several seconds. So I'm suspecting a firewall issue.
(Also, from FTP port closed for vsftpd service
lsof -i:21
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
vsftpd 12393 root 3u IPv4 63746670 0t0 TCP *:ftp (LISTEN)
)
Since this is Centos, I'm using firewalld. Port 21 appears to be open:
> firewall-cmd --list-services
dhcpv6-client ftp https ssh
and:
> firewall-cmd --list-ports
433/tcp 21/tcp 80/tcp 20/tcp
Also:
> firewall-cmd --get-default-zone
public
> firewall-cmd --get-active-zone
public
interfaces: enp0s25
and I have reloaded firewalld via firewall-cmd --reload
But if I try nmap from a remote machine, it claims ports 20 and 21 are filtered:
> nmap -p20,21 my.ftp.server.com
Starting Nmap 6.40 ( http://nmap.org ) at 2017-03-27 13:48 PDT
Nmap scan report for rrcs-xx-xx-xx-xx
(xx.xx.xx.xx)
Host is up (0.035s latency).
PORT STATE SERVICE
20/tcp filtered ftp-data
21/tcp filtered ftp
I even tracked looked through all the iptables rules, following firewalld's various chains, and found these:
> iptables -S IN_public_allow
-N IN_public_allow
-A IN_public_allow -p tcp -m tcp --dport 21 -m conntrack --ctstate NEW -j ACCEPT
-A IN_public_allow -p tcp -m tcp --dport 20 -m conntrack --ctstate NEW -j ACCEPT
I'm happy to post the entire output of iptables -S
if anyone thinks it would help.
Finally, I have switched off SELinux for just long enough to determine that I get the same behavior with it off as with it on.
So my questions are:
Could some other machine possibly be filtering port 21 traffic before it gets to my machine? (There is also a web server on this machine that I can connect to just fine). If so, how might I go about determining that?
Is there some other thing that I can check to debug this issue?
Any and all help are appreciated.