Troubleshooting FTP

[bswinnerton]

Hi everyone,

For some reason my FTP has stopped working. I can still FTP into the server when I am inside my network, but whenever I am outside of it I get the message saying that it "timed out". However I get the timeout message within about 5 seconds which isn't normal.

I have checked the firewall, and all ports for FTP are unblocked (20 & 21). I looked at the proftpd logs and when I try to ftp in, the logs say it worked. As you can see from the ip addresses 99.999.999.999 and 88.888.888.888 Anyways, the logs are attached. Can anyone help me troubleshoot what is going on?

Thanks

Oct 08 07:24:21 myserver.mydomain.com proftpd[5230] localhost: ProFTPD 1.3.1 (stable) (built Thu Feb 21 04:21:14 UTC 2008) standalone mode STARTUP
Oct 08 07:30:01 myserver.mydomain.com proftpd[5361] localhost (127.0.0.1[127.0.0.1]): FTP session opened.
Oct 08 07:30:01 myserver.mydomain.com proftpd[5361] localhost (127.0.0.1[127.0.0.1]): FTP session closed.
Oct 08 08:00:01 myserver.mydomain.com proftpd[5900] localhost (127.0.0.1[127.0.0.1]): FTP session opened.
Oct 08 08:00:01 myserver.mydomain.com proftpd[5900] localhost (127.0.0.1[127.0.0.1]): FTP session closed.
Oct 08 08:30:01 myserver.mydomain.com proftpd[6397] localhost (127.0.0.1[127.0.0.1]): FTP session opened.
Oct 08 08:30:01 myserver.mydomain.com proftpd[6397] localhost (127.0.0.1[127.0.0.1]): FTP session closed.
Oct 08 09:00:01 myserver.mydomain.com proftpd[6925] localhost (127.0.0.1[127.0.0.1]): FTP session opened.
Oct 08 09:00:01 myserver.mydomain.com proftpd[6925] localhost (127.0.0.1[127.0.0.1]): FTP session closed.
Oct 08 09:30:01 myserver.mydomain.com proftpd[7398] localhost (127.0.0.1[127.0.0.1]): FTP session opened.
Oct 08 09:30:01 myserver.mydomain.com proftpd[7398] localhost (127.0.0.1[127.0.0.1]): FTP session closed.
Oct 08 10:00:01 myserver.mydomain.com proftpd[7856] localhost (127.0.0.1[127.0.0.1]): FTP session opened.
Oct 08 10:00:01 myserver.mydomain.com proftpd[7856] localhost (127.0.0.1[127.0.0.1]): FTP session closed.
Oct 08 10:30:01 myserver.mydomain.com proftpd[8367] localhost (127.0.0.1[127.0.0.1]): FTP session opened.
Oct 08 10:30:01 myserver.mydomain.com proftpd[8367] localhost (127.0.0.1[127.0.0.1]): FTP session closed.
Oct 08 11:00:01 myserver.mydomain.com proftpd[8907] localhost (127.0.0.1[127.0.0.1]): FTP session opened.
Oct 08 11:00:01 myserver.mydomain.com proftpd[8907] localhost (127.0.0.1[127.0.0.1]): FTP session closed.
Oct 08 11:30:01 myserver.mydomain.com proftpd[9377] localhost (127.0.0.1[127.0.0.1]): FTP session opened.
Oct 08 11:30:01 myserver.mydomain.com proftpd[9377] localhost (127.0.0.1[127.0.0.1]): FTP session closed.
Oct 08 12:00:01 myserver.mydomain.com proftpd[9836] localhost (127.0.0.1[127.0.0.1]): FTP session opened.
Oct 08 12:00:01 myserver.mydomain.com proftpd[9836] localhost (127.0.0.1[127.0.0.1]): FTP session closed.
Oct 08 12:30:01 myserver.mydomain.com proftpd[10304] localhost (127.0.0.1[127.0.0.1]): FTP session opened.
Oct 08 12:30:01 myserver.mydomain.com proftpd[10304] localhost (127.0.0.1[127.0.0.1]): FTP session closed.
Oct 08 12:34:52 myserver.mydomain.com proftpd[10383] 99.999.999.999 (88.888.888.888[88.888.888.888]): FTP session opened.
Oct 08 12:34:52 myserver.mydomain.com proftpd[10383] 99.999.999.999 (88.888.888.888[88.888.888.888]): FTP session closed.
Oct 08 12:34:56 myserver.mydomain.com proftpd[10384] 99.999.999.999 (88.888.888.888[88.888.888.888]): FTP session opened.
Oct 08 12:34:56 myserver.mydomain.com proftpd[10384] 99.999.999.999 (88.888.888.888[88.888.888.888]): FTP session closed.
Oct 08 12:37:44 myserver.mydomain.com proftpd[5230] localhost: ProFTPD killed (signal 15)
Oct 08 12:37:44 myserver.mydomain.com proftpd[5230] localhost: ProFTPD 1.3.1 standalone mode SHUTDOWN
Oct 08 12:37:52 myserver.mydomain.com proftpd[10458] localhost: ProFTPD 1.3.1 (stable) (built Thu Feb 21 04:21:14 UTC 2008) standalone mode STARTUP

[falko]

Have you tried both active and passive transfers in your FTP client?

[bswinnerton]

Yes, I can't seem to figure it out. I have fail2ban installed. It seems as though port 20 is blocked, but it is not on my firewall. Could it be fail2ban or iptables? I haven't made any changes to them lately...

clientcomputer:~ username$ telnet mysite.com 20
Trying mysite.com...
telnet: connect to address mysite.com: Connection refused
telnet: Unable to connect to remote host

[falko]

Can you stop fail2ban and try again?

[chipsafts]

what about /etc/hosts.deny ?