VMware Communities: ftp-client-problem on esx 3 : "ftp: ...

VMware

Up to Discussions in ESX Server 3.x Configuration Archives

This Question is Answered

1 "correct" answer available (10 pts) 2 "helpful" answers available (6 pts)

8 Replies Last post: Feb 5, 2007 6:09 AM by langonej

ftp-client-problem on esx 3 : "ftp: connect: Connection refused" posted: Oct 20, 2006 6:04 AM

SirToby

46 posts since
Jan 5, 2006

Problem:
I cannot connect to my ftpserver (vsftpd, running on SLES 9 called SERVER3) from my ESX 3.0 host.
BUT:
I can connect to the above ftpserver (vsftpd, running on SLES 9 called SERVER3) from ANOTHER linux machine.
I can connect to another ftpserver (filezilla, running on Windows 2k) from the same ESX 3.0 host.

Heres the output:

Server 1 is ok connecting to SERVER 2 (Server 1 is a virtual SLES 9 Server, Server 2 is a physical SLES 9 Server)
root@SERVER1:/# ftp 10.100.112.32
Connected to 10.100.112.32.
220 (vsFTPd 1.2.1)
Name (10.100.112.32:vmuser): test
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
229 Entering Extended Passive Mode (|||15566|)
150 Here comes the directory listing.
drwxr-xr-x 2 1002 100 80 Oct 20 12:36 Documents
drwxr-xr-x 2 1002 100 48 Oct 20 12:36 bin
drwxr-xr-x 2 1002 100 80 Oct 20 12:36 public_html
226 Directory send OK.
ftp>

[root@SERVER3 /]# ftp 10.100.112.32
Connected to 10.100.112.32 (10.100.112.32).
220 (vsFTPd 1.2.1)
Name (10.100.112.32:root): test
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
227 Entering Passive Mode (10,100,112,32,154,20)
ftp: connect: Connection refused
ftp>

Question: What is wrong with ftp, probably on my ESX 3.0-Server side?

Re: ftp-client-problem on esx 3 : "ftp: connect: Connection refused"

1. Oct 20, 2006 6:07 AM

in response to: SirToby

SirToby

46 posts since
Jan 5, 2006

Sorry, got mixed up the server names SERVER1 etc.
To get what I mean, mind the IPs. Sorry.

Re: ftp-client-problem on esx 3 : "ftp: connect: Connection refused"

2. Oct 20, 2006 6:25 AM

in response to: SirToby

boydd

5,707 posts since
Jun 15, 2004

DNS entries correct? Reverse lookup entry so sles can verify host.

DB

Re: ftp-client-problem on esx 3 : "ftp: connect: Connection refused"

3. Oct 20, 2006 4:46 PM

in response to: boydd

SirToby

46 posts since
Jan 5, 2006

Thanks for your reply.
- It works fine with the SLES - machnine so why should it not work with the ESX 3.0 machine?
I don't know what to do concerning DNS lookup. It can find the machine?!!
michael

Re: ftp-client-problem on esx 3 : "ftp: connect: Connection refused"

4. Oct 21, 2006 12:37 PM

in response to: SirToby

squirrelking

81 posts since
Dec 9, 2004

What does your firewall configuration look like on your ESX server?

List output of:
esxcfg-firewall -q

Re: ftp-client-problem on esx 3 : "ftp: connect: Connection refused"

5. Oct 21, 2006 12:45 PM

in response to: SirToby

SirToby

46 posts since
Jan 5, 2006

Thanks for asking, but I can do that not now but will do on monday.
Michael

Re: ftp-client-problem on esx 3 : "ftp: connect: Connection refused"

6. Oct 22, 2006 11:30 PM

in response to: SirToby

SirToby

46 posts since
Jan 5, 2006

Heres the output of esxcfg-firewall -q. ftp-service seems to be enabled.

(I tried another ftpclient (ncftpput to upload), but same message, connection refused).

[root@sjb1k9221 /]# esxcfg-firewall -q
Chain INPUT (policy DROP 130K packets, 20M bytes)
pkts bytes target prot opt in out source destination
551K 602M ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
32688 8695K valid-tcp-flags tcp -- * * 0.0.0.0/0 0.0.0.0/0
32688 8695K valid-source-address !udp -- * * 0.0.0.0/0 0.0.0.0/0
152K 28M valid-source-address-udp udp -- * * 0.0.0.0/0 0.0.0.0/0
101 5172 valid-source-address tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x16/0x02
0 0 icmp-in icmp -- * * 0.0.0.0/0 0.0.0.0/0
32609 8693K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
44 2112 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:902 state NEW
31 1692 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 state NEW
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 state NEW
14422 4809K ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spts:67:68 dpts:67:68
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpts:2050:5000 state NEW
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpts:2050:5000 state NEW
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpts:8042:8045 state NEW
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpts:8042:8045 state NEW
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:427
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:427 state NEW
16 768 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 state NEW
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:5989 state NEW
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:5988 state NEW

Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
551K 602M ACCEPT all -- * lo 0.0.0.0/0 0.0.0.0/0
36895 27M valid-tcp-flags tcp -- * * 0.0.0.0/0 0.0.0.0/0
0 0 icmp-out icmp -- * * 0.0.0.0/0 0.0.0.0/0
25 1817 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spts:1024:65535 dpt:53
36865 27M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:902 state NEW
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spts:67:68 dpts:67:68
4 230 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpts:2050:5000 state NEW
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpts:2050:5000 state NEW
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpts:8042:8045 state NEW
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpts:8042:8045 state NEW
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:427
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:427 state NEW
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:27000 state NEW
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:27010 state NEW
12 700 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:21 ctstate NEW,RELATED
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:902 state NEW
14 840 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable

Chain icmp-in (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 0
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 3 code 4
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0

Chain icmp-out (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 0
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0

Chain log-and-drop (7 references)
pkts bytes target prot opt in out source destination
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 6 level 7
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0

Chain valid-source-address (2 references)
pkts bytes target prot opt in out source destination
0 0 DROP all -- * * 127.0.0.1 0.0.0.0/0
0 0 DROP all -- * * 0.0.0.0/8 0.0.0.0/0
0 0 DROP all -- * * 0.0.0.0/0 255.255.255.255

Chain valid-source-address-udp (1 references)
pkts bytes target prot opt in out source destination
0 0 DROP all -- * * 127.0.0.1 0.0.0.0/0
8298 2975K DROP all -- * * 0.0.0.0/8 0.0.0.0/0

Chain valid-tcp-flags (2 references)
pkts bytes target prot opt in out source destination
0 0 log-and-drop tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x00
0 0 log-and-drop tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x11/0x01
0 0 log-and-drop tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x18/0x08
0 0 log-and-drop tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x30/0x20
0 0 log-and-drop tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x03/0x03
0 0 log-and-drop tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x06
0 0 log-and-drop tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x05/0x05

Incoming and outgoing ports blocked by default.
Enabled services: AAMClient CIMSLP LicenseClient ftpClient sshServer CIMHttpsServer CIMHttpServer vpxHeartbeats

Opened ports:

[root@sjb1k9221 /]#

Re: ftp-client-problem on esx 3 : "ftp: connect: Connection refused"

7. Nov 3, 2006 4:39 AM

in response to: SirToby

SirToby

46 posts since
Jan 5, 2006

Hello:
found the solution while updating to 3.0.1:
On service console:
esxcfg-firewall --AllowOutgoing

does the trick.
It's weired: ftp is working fine when you activate ftp-client in VI Client. BUT only to the FileZilla Server on the W2kServer, not to my ncftp on SLES9. For that the above is necessary. Strange.

Re: ftp-client-problem on esx 3 : "ftp: connect: Connection refused"

8. Feb 5, 2007 6:09 AM

in response to: SirToby

langonej

248 posts since
May 24, 2005

I'm having the same issue. I opened 20 and 21 TCP outgoing for FTP and I can connect to my external FTP server but I can not perform an "ls" or a file transfer.

If I open up all outgoing ports it works fine.

Go to original post

Search VMware Communities Advanced Search

Actions

View as PDF

Up to Discussions in ESX Server 3.x Configuration Archives