I'm a complete noob and am just having the worst time trying to get FTP access to the server.   I want to keep the firewall enabled.Edit:  Updated the iptables information.I have the following rules enabled:Chain INPUT (policy DROP 0 packets, 0 bytes) pkts bytes target     prot opt in     out     source               destination58398 7869K RH-Firewall-1-INPUT  all  --  *      *       0.0.0.0/0            0.0.0.0/0    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:22    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:21    0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:!0x17/0x02 state NEW    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:21 state NEWChain FORWARD (policy DROP 0 packets, 0 bytes) pkts bytes target     prot opt in     out     source               destination    0     0 RH-Firewall-1-INPUT  all  --  *      *       0.0.0.0/0            0.0.0.0/0Chain OUTPUT (policy DROP 5841 packets, 350K bytes) pkts bytes target     prot opt in     out     source               destination 4046  299K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED    2   114 ACCEPT     all  --  *      lo      0.0.0.0/0            0.0.0.0/0 2935  196K ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:53 state NEW  170 10200 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:21 ctstate NEW,ESTABLISHED    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:20 ctstate NEW,ESTABLISHEDChain RH-Firewall-1-INPUT (2 references) pkts bytes target     prot opt in     out     source               destination    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:80    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:3306   26 10260 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           icmp type 255    0     0 ACCEPT     esp  --  *      *       0.0.0.0/0            0.0.0.0/0    0     0 ACCEPT     ah   --  *      *       0.0.0.0/0            0.0.0.0/0    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            224.0.0.251         udp dpt:5353    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:631    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:631 8465  774K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:2249907 7084K REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpts:30000:35000    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:21    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:20    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:21    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:22    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:21    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:20    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:21 ctstate NEW,ESTABLISHED    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:20 ctstate NEW,ESTABLISHED    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state ESTABLISHEDI know it's waaaay more than necessary, but I'm at my wits end.  I can connect to the server just fine when I disable iptables, so I know it has something to do with the firewall.I'd just like to connect, using port 21 and a passive connection.  I'd like to open ports 39000 through 40000 for the passive connection.What do I do?AHA!  I fixed it!  I took another look at the rules and marked down which number rule that reject one was.  I had a hunch it was blocking the rules after it, and it was!So, it was the following rule that was blocking my connections:49907 7084K REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibitedSo what I did to fix it, was restart the server which reset the rules, and then added my port 21 rule to be before that reject rule: sudo iptables -I RH-Firewall-1-INPUT 11 -p tcp -m tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT sudo iptables -I RH-Firewall-1-INPUT 11 -p tcp -m tcp --dport 39000:40000 -m state --state RELATED,ESTABLISHED -j ACCEPTThen, I added the following to my vsftpd.conf:pasv_enable=YESpasv_max_port=39000pasv_min_port=40000Now I can connect, hooray!
Absolutely cannot get FTP access after adding many rules to iptables in CentOS5
centos;iptables;vsftpd
Here's my answer from the question:AHA!  I fixed it!  I took another look at the rules and marked down which number rule that reject one was.  I had a hunch it was blocking the rules after it, and it was!So, it was the following rule that was blocking my connections:49907 7084K REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibitedSo what I did to fix it, was restart the server which reset the rules, and then added my port 21 rule to be before that reject rule: sudo iptables -I RH-Firewall-1-INPUT 11 -p tcp -m tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT sudo iptables -I RH-Firewall-1-INPUT 11 -p tcp -m tcp --dport 39000:40000 -m state --state RELATED,ESTABLISHED -j ACCEPTThen, I added the following to my vsftpd.conf:pasv_enable=YESpasv_max_port=40000pasv_min_port=39000Now I can connect, hooray!