ProFTPd access denied from outside LAN


I use ProFTPd for all my virtual servers. And accessing has never been a problem.
I even used it to share files with other people all over the world.

For some reason all access from outside my LAN is denied recently.
I haven’t changed anything (Don’t change anything if it’s not broken)…

After a lot of searching on the web, all i could find was opening up ports for passive connections and using MasqueradeAddress . So i added those lines in the config file and opened up the ports in my router.
It gives me a 530 error (access denied).
When trying to log in using an FTP client it shows me the connection with the server is established, but as soon as the login credentials are checked, it returns the error.

Is there anyone with knowledge to assist me with this one?

My config file is below.

# # /etc/proftpd/proftpd.conf -- This is a basic ProFTPD configuration file. # To really apply changes, reload proftpd after modifications, if # it runs in daemon mode. It is not required in inetd/xinetd mode. #

Includes DSO modules

Include /etc/proftpd/modules.conf

Set off to disable IPv6 support which is annoying on IPv4 only boxes.

UseIPv6 off

If set on you can experience a longer connection delay in many cases.

IdentLookups off

ServerName “Debian”
ServerType standalone
DeferWelcome off

MultilineRFC2228 on
DefaultServer on
ShowSymlinks on

TimeoutNoTransfer 600
TimeoutStalled 600
TimeoutIdle 1200

DisplayLogin welcome.msg
DisplayChdir .message true
ListOptions “-l”

DenyFilter *.*/

Use this to jail all users in their homes

DefaultRoot ~

Users require a valid shell listed in /etc/shells to login.

Use this directive to release that constrain.

RequireValidShell off

Port 21 is the standard FTP port.

Port 21

In some cases you have to specify passive ports range to by-pass

firewall limitations. Ephemeral ports can be used for that, but

feel free to use a more narrow range.

PassivePorts 60000 60100

If your host was NATted, this option is useful in order to

allow passive tranfers to work. You have to use your public

address and opening the passive ports used on your firewall as well.


This is useful for masquerading address with dynamic IPs:

refresh any configured MasqueradeAddress directives every 8 hours

DynMasqRefresh 28800

To prevent DoS attacks, set the maximum number of child processes

to 30. If you need to allow more than 30 concurrent connections

at once, simply increase this value. Note that this ONLY works

in standalone mode, in inetd mode you should use an inetd server

that allows you to limit maximum number of processes per service

(such as xinetd)

MaxInstances 30

Set the user and group that the server normally runs at.

User proftpd
Group nogroup

Umask 022 is a good standard umask to prevent new files and dirs

(second parm) from being group and world writable.

Umask 022 022

Normally, we want files to be overwriteable.

AllowOverwrite on

Uncomment this if you are using NIS or LDAP via NSS to retrieve passwords:

PersistentPasswd off

This is required to use both PAM-based authentication and local passwords

AuthOrder mod_auth_pam.c* mod_auth_unix.c

Be warned: use of this directive impacts CPU average load!

Uncomment this if you like to see progress and transfer rate with ftpwho

in downloads. That is not needed for uploads rates.

UseSendFile off

TransferLog /var/log/proftpd/xferlog
SystemLog /var/log/proftpd/proftpd.log

Logging onto /var/log/lastlog is enabled but set to off by default

#UseLastlog on

In order to keep log file dates consistent after chroot, use timezone info

from /etc/localtime. If this is not set, and proftpd is configured to

chroot (e.g. DefaultRoot or ), it will use the non-daylight

savings timezone regardless of whether DST is in effect.

#SetEnv TZ :/etc/localtime

QuotaEngine off Ratios off

Delay engine reduces impact of the so-called Timing Attack described in

It is on by default.

DelayEngine on ControlsEngine off ControlsMaxClients 2 ControlsLog /var/log/proftpd/controls.log ControlsInterval 5 ControlsSocket /var/run/proftpd/proftpd.sock AdminControlsEngine off

Alternative authentication frameworks

#Include /etc/proftpd/ldap.conf
#Include /etc/proftpd/sql.conf

This is used for FTPS connections

#Include /etc/proftpd/tls.conf

Useful to keep VirtualHost/VirtualRoot directives separated

#Include /etc/proftpd/virtuals.conf

A basic anonymous configuration, no upload directories.

<Anonymous ~ftp>

User ftp

Group nogroup

# We want clients to be able to login with “anonymous” as well as “ftp”

UserAlias anonymous ftp

# Cosmetic changes, all files belongs to ftp user

DirFakeUser on ftp

DirFakeGroup on ftp

RequireValidShell off

# Limit the maximum number of anonymous logins

MaxClients 10

# We want ‘welcome.msg’ displayed at login, and ‘.message’ displayed

# in each newly chdired directory.

DisplayLogin welcome.msg

DisplayChdir .message

# Limit WRITE everywhere in the anonymous chroot

<Directory *>


# Uncomment this if you’re brave.


# # Umask 022 is a good standard umask to prevent new files and dirs

# # (second parm) from being group and world writable.

# Umask 022 022


# DenyAll



# AllowAll



Include other custom configuration files

#Order allow,deny

Include /etc/proftpd/conf.d/
#AllowForeignAddress on
#IdentLookups off
#RequireValidShell off

PassivePorts 60000 60100
Did you open this range on your firewall?

Tried other port ranges aswell.


Is your server behind a NAT router? If so, are the ports being forwarded to you FTP service? And can you verify that it’s the correct server it’s being forwarded to?

Also, do you see any errors in the log files on your server when trying to log in?


Yes, it is behind a NAT router.
There are absolutely no errors in the log and i am sure the ports are opened and forwarded to the right ip.

However,… i have updated my router with the latest firmware and the problems are gone.

I still dont know what caused this. I made a backup of my router settings and restored those after the firmware upgrade. So i am quite sure the settings were ok.

Since this issue is fixed (eventhough i dont know how), this topic can be closed.

Thanks for the replies though :slight_smile: