On 09/06/2013 03:43 PM, Patrick Dupre issued this missive: Yes, you have to modify your firewall configuration. For FTPS, you must allow incoming connections to port TCP port 990. To permit passive FTPS data, then you must also allow incoming TCP connections for a range of ports that the server will use for passive data connections. You must also tell your FTP daemon which ports those are. I'm not sure how you tell pure-ftpd which ports it can use for passive connections, but in vsftpd they're specified by the "pasv_min_port" and "passv_max_port" variables in the vsftpd.conf file. My server allow passive FTP/FTPS data over ports 20,000-20,100, so my firewall allows incoming connections for TCP ports 21, 990 and 20000 through 20100. My vsftpd.conf file contains: passv_min_port=20000 passv_max_port=20100 And away we go. ---------------------------------------------------------------------- - Rick Stevens, Systems Engineer, AllDigital ricks(a)alldigital.com - - AIM/Skype: therps2 ICQ: 22643734 Yahoo: origrps2 - - - - "How does that damned three seashell thing work?" - - -- Sylvester Stallone, "Demolition Man" - ----------------------------------------------------------------------

Am 07.09.2013 08:38, schrieb Rejy M Cyriac: did you read the subject? did you try it? as i have alreday said: 'ip_conntrack_ftp' does *not* work with encrypted connections why? because it hardly can read the answer which port was negotiated for ftp-data you may try it, been there done that