Articles in this section

See more

Passive FTP connection does not work after enabling Plesk Firewall

Avatar
Alexander Tsmokalyuk
Updated
Follow

Applicable to:

  • Plesk Onyx for Linux

Symptoms

  1. Passive FTP connection (plain, non-SSL/TLS) does not work after enabling Plesk Firewall Tools & Settings > Firewall > Enable
  2. Cannot list directory when connecting in passive mode:

    # ftp> dir
    227 Entering Passive Mode (192,0,2,2,176,121).
    ftp: connect: Connection timed out

  3. The following errors appear in /var/log/messages:

    CONFIG_TEXT: xinetd[2457]: START: ftp pid=4513 from=::ffff:203.0.113.2
    proftpd[4513]: processing configuration directory '/etc/proftpd.d'
    proftpd[4513]: FTP session opened.
    named[3167]: error (network unreachable) resolving

  4. The following errors appear in /var/log/secure:

    CONFIG_TEXT: proftpd: pam_listfile(proftpd:auth): Couldn't open /etc/ftpusers
    proftpd[4513]: (203.0.113.2) - USER username: Login successful.

  5. passive FTP ports are configured and allowed in firewall
  6. nf_conntrack_ftp module is not loaded:

    # lsmod | grep conntrack_ftp
    #

Cause

The described behavior is expected if nf_conntrack_ftp module is not loaded.

This is Plesk bug with ID PPPM-6187: the notification in Plesk UI will be added in future Plesk updates.

Resolution

Note: This article may require additional administrative knowledge to apply. If any help required, contact server’s administrator or hosting support.

  1. Make sure all above symptoms present.
  2. Log in to Plesk server via SSH

  3. Enable the kernel modules in the system:

    Note: Actions that involves kernel modules configuration should be performed on a physical or a virtual machine with full hardware emulation. If a VZ container is used, the same actions should be performed on a hardware node where this VZ container is running.

    2.1. Add the modules to the configuration file:

    # echo nf_nat_ftp >> /etc/modules-load.d/modules.conf
    # echo nf_conntrack_ftp >> /etc/modules-load.d/modules.conf

    2.2. On CentOS/RHEL-based distributions, add the modules to the IPTABLES_MODULES line in the /etc/sysconfig/iptables-config file as follows:

    # cat /etc/sysconfig/iptables-config | grep IPTABLES_MODULES
    IPTABLES_MODULES="nf_conntrack_ftp ip_nat_ftp"

Comments

10 comments

Sort by Date Votes

Please sign in to leave a comment.

Have more questions? Submit a request

Related articles