PHP function ftp_nlist() and ftp active mode

Jun

2009

Under debian, to correctly use the php function ftp_nlist() with a remote server behind a firewall, you must have activated the ip_conntrack_ftp module under penalty of having one of the following errors:

PHP Warning:  ftp_nlist() [function.ftp-nlist]: php_connect_nonb() failed: Connection timed out (110) in /test_ftp.php on line 58
PHP Warning:  ftp_nlist() [function.ftp-nlist]: php_connect_nonb() failed: No route to host (113) in /test_ftp.php on line 58

The installation of the module is done with modprobe:

modprobe ip_conntrack_ftp

Explanation of the error:
Active FTP mode is the FTP client that determines the connection port to use for data transfer. For the exchange of data can be done, the FTP server is initializing the connection to its data port (port 20) to the port specified by the customer.

The problem in the case of using a firewall like iptables (ie acting on in relation to address IPs and ports) on a server is the need to specify port numbers that are allows or denies. In this case, it does not know the number of ports opened by the server because it is the customer who requests it when connecting.

That's the ip_conntrack modules, these modules take care to inform the system on the port openings.
In order to achieve a firewall managing these protocols must be loaded ip_conntrack modules:

- Ip_conntrack: To allow connections based on their statements (NEW, ESTABLISHED, RELATED ...)
- Ip_conntrack_irc: You can make the irc through monitoring connection
- Ip_conntrack_ftp: allows you to FTP called "active"