FTP Error 500, illegal port command

[Debbie Fleith]

After making some changes on our firewall, we can no longer send/receive files from our FTP server. We login just fine, so the port forwarding appears to be working. However, when we attempt to send or receive any files, we get the following error:
"500 Illegal PORT Command 425 Can't build data connection: Connection refused."
We also get the "500 Illegal Port command" error when we try to issue any other commands like ls.

Does anyone know what is wrong?

[Mark Bainter]

Well, I'd guess it's the changes you made to your firewall. ;-) FTP by default makes a return connection for data transfers. Your firewall is no longer allowing that. You have a couple of options.

1) Use passive mode for FTP. This is the easiest, assuming your client supports it.

2) Setup your kernel/firewall to use the netfilter options for allowing ftp.

If you can give a little more info on your specific firewall setup (are you using ipchains or iptables? What kernel revision?) I can probably give you more specifics on getting it setup if you need.

[Mark Bainter]

Well, I'd guess it's the changes you made to your firewall. ;-) FTP by default makes a return connection for data transfers. Your firewall is no longer allowing that. You have a couple of options.

1) Use passive mode for FTP. This is the easiest, assuming your client supports it.

2) Setup your kernel/firewall to use the netfilter options for allowing ftp. The specific modules/options in question in 2.4 kernels is the ip_nat_ftp, and ip_conntrack_ftp. If you have them built as modules (check /lib/modules-2.4.yourkernelversion/kernel/net/ipv4/netfilter for the modules) then just add a line to call modprobe in your firewall script.

If you can give a little more info on your specific firewall setup (are you using ipchains or iptables? What kernel revision?) I can probably give you more specifics on getting it setup if you need.

[U.SivaKumar_2]

Hi,

Give this FTP command before giving anyother ftp command
ftp:ftpserver>PASV

Then try giving
ftp:ftpserver>ls

Does the error come now ?


regards,
U.Sivakumar