[SOLVED] 425 Could not open data connection to port XXXXX: Connection refused

razor7 · Jun 2, 2018

Hi! I'm trying to remotely connect to ftp through TLS but I'm getting connection refused errors Pure-FTPd server. Please advise to solve this. Thanks!

I have:

Added the port range to the ISPConfig firewall Open TCP ports setting ...40110:40210

Set port range in pure-ftpd/conf ~/ echo "40110 40210" > /etc/pure-ftpd/conf/PassivePortRange

Ran /etc/init.d/pure-ftpd-mysql restart and even restarted the whole server

Opened port range in router (DD-WRT) ->NAT/QoS -> Port Range Forwarding: Application "FTP TLS" Start "40110" End "40210" Protocol "Both" IP Address "10.0.0.XX"

Opened port 21 in router and tested it

Rebooted the router

With all that done, I'm getting 425 Could not open data connection to port 40160: Connection refused

To connect, I'm logged into the ssh shell of a HostGator web server that has lftp command which I'm running like this lftp -d -f /home/XXXX/backs/ftp_command.tmp

The ftp_commands.tmp file contains this:

set ftpassive-mode no
set ftport-range 40110-40210
set ftp:ssl-force yes
set ssl:verify-certificate no
open ftp.server.com
login hosting_backups PASSWORD_HIDDEN
lcd /home/XXXX/backs/
ls
bye
Click to expand...

FTP connection log:

---- Resolving host address...
---- 1 address found: 181.1.95.XXX
---- Connecting to it.XXXXXXXXX.com.ar (181.1.95.XXX) port 21
<--- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------
<--- 220-You are user number 3 of 50 allowed.
<--- 220-Local time is now 13:34. Server port: 21.
<--- 220-This is a private system - No anonymous login
<--- 220-IPv6 connections are also welcome on this server.
<--- 220 You will be disconnected after 15 minutes of inactivity.
---> FEAT
<--- 211-Extensions supported:
<--- EPRT
<--- IDLE
<--- MDTM
<--- SIZE
<--- MFMT
<--- REST STREAM
<--- MLST type*;size*;sizd*;modify*;UNIX.mode*;UNIX.uid*;UNIX.gid*;unique*;
<--- MLSD
<--- AUTH TLS
<--- PBSZ
<--- PROT
<--- UTF8
<--- ESTA
<--- PASV
<--- EPSV
<--- SPSV
<--- ESTP
<--- 211 End.
---> AUTH TLS
<--- 234 AUTH TLS OK.
---> OPTS UTF8 ON
Certificate: C=AR,ST=Buenos Aires,L=Vicente Lopez,O=MGS Creativa,OU=it,CN=it.XXXXXXXXX.com.ar,[email protected]
Issued by: C=AR,ST=Buenos Aires,L=Vicente Lopez,O=MGS Creativa,OU=it,CN=it.XXXXXXXXX.com.ar,[email protected]
WARNING: Certificate verification: Not trusted
<--- 200 OK, UTF-8 enabled
---> OPTS MLST type;size;modify;UNIX.mode;UNIX.uid;UNIX.gid;
<--- 200 MLST OPTS type;size;sizd;modify;UNIX.mode;UNIX.uid;UNIX.gid;unique;
---> USER hosting_backups
<--- 331 User hosting_backups OK. Password required
---> PASS PASSWORD_HIDDEN
<--- 230 OK. Current restricted directory is /
---> PWD
<--- 257 "/" is your current location
---> PBSZ 0
<--- 200 PBSZ=0
---> PROT P
<--- 200 Data protection level set to "private"
---> PASV
<--- 227 Entering Passive Mode (10,0,0,77,156,204)
---- Address returned by PASV seemed to be incorrect and has been fixed
---- Connecting data socket to (181.1.95.XXX) port 40140
**** Socket error (Connection refused) - reconnecting
---- Switching passive mode off
---> LIST
---> ABOR
---- Closing aborted data socket
---- Closing control socket
---- Connecting to it.XXXXXXXXX.com.ar (181.1.95.XXX) port 21
<--- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------
<--- 220-You are user number 4 of 50 allowed.
<--- 220-Local time is now 13:35. Server port: 21.
<--- 220-This is a private system - No anonymous login
<--- 220-IPv6 connections are also welcome on this server.
<--- 220 You will be disconnected after 15 minutes of inactivity.
---> FEAT
<--- 211-Extensions supported:
<--- EPRT
<--- IDLE
<--- MDTM
<--- SIZE
<--- MFMT
<--- REST STREAM
<--- MLST type*;size*;sizd*;modify*;UNIX.mode*;UNIX.uid*;UNIX.gid*;unique*;
<--- MLSD
<--- AUTH TLS
<--- PBSZ
<--- PROT
<--- UTF8
<--- ESTA
<--- PASV
<--- EPSV
<--- SPSV
<--- ESTP
<--- 211 End.
---> AUTH TLS
<--- 234 AUTH TLS OK.
---> OPTS UTF8 ON
Certificate: C=AR,ST=Buenos Aires,L=Vicente Lopez,O=MGS Creativa,OU=it,CN=it.XXXXXXXXX.com.ar,[email protected]
Issued by: C=AR,ST=Buenos Aires,L=Vicente Lopez,O=MGS Creativa,OU=it,CN=it.XXXXXXXXX.com.ar,[email protected]
WARNING: Certificate verification: Not trusted
<--- 200 OK, UTF-8 enabled
---> OPTS MLST type;size;modify;UNIX.mode;UNIX.uid;UNIX.gid;
<--- 200 MLST OPTS type;size;sizd;modify;UNIX.mode;UNIX.uid;UNIX.gid;unique;
---> USER hosting_backups
<--- 331 User hosting_backups OK. Password required
---> PASS PASSWORD_HIDDEN
<--- 230 OK. Current restricted directory is /
---> PBSZ 0
<--- 200 PBSZ=0
---> PROT P
<--- 200 Data protection level set to "private"
---> PORT 192,185,4,177,156,224
<--- 200 PORT command successful
---> LIST
<--- 425 Could not open data connection to port 40160: Connection refused
---- Closing data socket
---> PORT 192,185,4,177,157,15
<--- 200 PORT command successful
---> LIST
<--- 425 Could not open data connection to port 40207: Connection refused
---- Closing data socket
---> PORT 192,185,4,177,156,239
<--- 200 PORT command successful
---> LIST
<--- 425 Could not open data connection to port 40175: Connection refused
---- Closing data socket
---> PORT 192,185,4,177,156,200
<--- 200 PORT command successful
---> LIST
<--- 425 Could not open data connection to port 40136: Connection refused
---- Closing data socket
---> PORT 192,185,4,177,157,12
<--- 200 PORT command successful
---> LIST
<--- 425 Could not open data connection to port 40204: Connection refused
---- Closing data socket
---> PORT 192,185,4,177,156,239
<--- 200 PORT command successful
---> LIST
<--- 425 Could not open data connection to port 40175: Connection refused
---- Closing data socket
---> PORT 192,185,4,177,156,196
<--- 200 PORT command successful
---> LIST
<--- 425 Could not open data connection to port 40132: Connection refused
---- Closing data socket
'ls' at 0 [Delaying before retry]
Click to expand...

razor7 · Jun 5, 2018

Bump...

Jesse Norell · Jun 5, 2018

This is passive mode failing on port 40140:

razor7 said: ↑

---> PASV
<--- 227 Entering Passive Mode (10,0,0,77,156,204)
---- Address returned by PASV seemed to be incorrect and has been fixed
---- Connecting data socket to (181.1.95.XXX) port 40140
**** Socket error (Connection refused) - reconnecting---> PASV
<--- 227 Entering Passive Mode (10,0,0,77,156,204)
---- Address returned by PASV seemed to be incorrect and has been fixed
---- Connecting data socket to (181.1.95.XXX) port 40140
**** Socket error (Connection refused) - reconnecting
Click to expand...

You need to re-check exactly the things you said you have done, ie. set the passive port range (which is effective, because 40140 falls within the range), open the firewall for your port range on the local server and on your network level firewall(s), and port forward the range of ports in your NAT to your ftp server.

Also you might want to set the ip address pureftpd announces (rather than 10.0.0.77). That is not what's causing the failure in this case as your ftp client was smart enough to know it wasn't right, but other ftp clients will have a problem there.

This is active mode failing:

razor7 said: ↑

---> LIST
<--- 425 Could not open data connection to port 40160: Connection refused
---- Closing data socket
Click to expand...

Ie. the ftp server was unable to connect back to your client on port 40160. You set the same port range for the client as on the server in your ftp_commands.tmp, which isn't necessary, though doesn't hurt anything. Generally you just setup the server side, so any client can use passive mode to it, but having a TLS compatible ftp client setup could be useful for you if you use many ftp servers.

If you want active mode to work (ie. where the server connects back to your client for all data transfers), you will need to open that same port range in the firewall(s) on the client end, and likewise forward that port range in your NAT on the client side if there is one. As you mentioned your current ftp client is on a hostgator hosting server, you probably don't have control over this, and you'll just need to work on the server end so passive mode ftp works.

razor7 · Jun 9, 2018

Well my setup is OK, the issue comes at the HostGator web server where I need to connect from, seems that they have blocked access to some ports.

I have tested my setup from another server outside my LAN and works!

Log in or Sign up

[SOLVED] 425 Could not open data connection to port XXXXX: Connection refused

razor7 Member

razor7 Member

Jesse Norell Well-Known Member Staff Member Howtoforge Staff

razor7 Member

Share This Page

Log in or Sign up

[SOLVED] 425 Could not open data connection to port XXXXX: Connection refused

razor7 Member

razor7 Member

Jesse Norell Well-Known Member Staff Member Howtoforge Staff

razor7 Member

Share This Page

Useful Searches