Securing your server by restricting FTP access is essential for preventing unauthorized access. Here’s how you can block FTP (port 21) using IPTables (default system firewall) and CSF (ConfigServer Security & Firewall).
Block FTP Access Using IPTables
1. Completely Disable FTP Access
To block all FTP connections on the server, run:
iptables -A INPUT -p tcp –dport 21 -j DROP
2. Block FTP Access for a Specific IP
If you want to deny FTP access for a specific IP (e.g., 10.10.10.10), use:
iptables -A INPUT -p tcp -s 10.10.10.10 --dport 21 -j DROP
3. Block FTP Access for a Subnet
To block FTP access for an entire subnet (e.g., 10.10.10.0/24), use:
iptables -I INPUT -p tcp -s 10.10.10.0/24 --dport 21 -j DROP
4. Save and Apply IPTables Rules
After adding the rules, save them:
/etc/init.d/iptables save
Then restart IPTables to apply changes:
/etc/init.d/iptables restart
Block FTP Access Using CSF Firewall
1. Completely Disable FTP Access
Edit the CSF configuration file:
vi /etc/csf/csf.conf
Find the line:
# Allow incoming TCP ports
TCP_IN =
Remove port 21 from the list, save the file, and restart CSF:
csf -r
2. Block FTP Access for a Specific IP
Edit the csf.deny file:
vi /etc/csf/csf.deny
Add the following line:
tcp:in:d=21:s=10.10.10.10
Save the file and restart CSF:
csf -r
3. Allow FTP Access for a Specific IP and Deny All Others
To allow FTP for a specific IP while blocking all others:
i) Edit the csf.conf file:
vi /etc/csf/csf.conf
Remove port 21 from:
# Allow incoming TCP ports
Remove port 21 from:
# Allow outgoing TCP ports
Save the file.
ii) Edit the csf.allow file:
vi /etc/csf/csf.allow
Add this entry:
tcp:in:d=21:s=10.10.10.10
Save the file and restart CSF:
csf -r
Conclusion
By following these steps, you can secure your server by blocking FTP access entirely, restricting it to specific IPs, or allowing FTP access only for trusted sources. Always test firewall rules to avoid accidental lockouts and ensure smooth server operation.