Passive FTP issue in Xen SolusVM

When trying to connect the server via FTP, Xen servers on SolusVM often has an issue. Below is the error in /var/log/messages.

kernel:nf_ct_ftp: dropping packetIN= OUT=eth0 SRC=xx.xx.xx.xx DST=xx.xx.xx.xx LEN=53 TOS=0x00 PREC=0x00 TTL=64 ID=43890 DF PROTO=TCP SPT=21 DPT=50039 SEQ=3896866935 ACK=2493276111 WINDOW=14600 RES=0x00 ACK PSH FIN URGP=0 UID=0 GID=0

This is due to additional iptables modules enabled which are not required on Xen. Login to your Xen node via SSH & access file “/etc/sysconfig/iptables-config“. Find for line below.

IPTABLES_MODULES=”ipt_REJECT ipt_tos ipt_TOS ipt_LOG ip_conntrack ipt_limit ipt_multiport iptable_filter iptable_mangle ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_length ipt_state iptable_nat ip_nat_ftp ipt_owner ipt_REDIRECT”

Replace it with

IPTABLES_MODULES=”ip_conntrack_netbios_ns”

Restart iptables and you should be able to connect via FTP.