Securing your server by restricting FTP access is essential for preventing unauthorized access. Here’s how you can block FTP (port 21) using IPTables (default system firewall) and CSF (ConfigServer Security & Firewall).

Block FTP Access Using IPTables

1. Completely Disable FTP Access
To block all FTP connections on the server, run:

iptables -A INPUT -p tcp –dport 21 -j DROP

2. Block FTP Access for a Specific IP

If you want to deny FTP access for a specific IP (e.g., 10.10.10.10), use:

iptables -A INPUT -p tcp -s 10.10.10.10 --dport 21 -j DROP

3. Block FTP Access for a Subnet

To block FTP access for an entire subnet (e.g., 10.10.10.0/24), use:

iptables -I INPUT -p tcp -s 10.10.10.0/24 --dport 21 -j DROP

4. Save and Apply IPTables Rules
After adding the rules, save them:

/etc/init.d/iptables save

Then restart IPTables to apply changes:

/etc/init.d/iptables restart



Block FTP Access Using CSF Firewall

1. Completely Disable FTP Access
Edit the CSF configuration file:

vi /etc/csf/csf.conf

Find the line:

# Allow incoming TCP ports
TCP_IN =

Remove port 21 from the list, save the file, and restart CSF:

csf -r

2. Block FTP Access for a Specific IP
Edit the csf.deny file:

vi /etc/csf/csf.deny

Add the following line:
tcp:in:d=21:s=10.10.10.10

Save the file and restart CSF:
csf -r

3. Allow FTP Access for a Specific IP and Deny All Others

To allow FTP for a specific IP while blocking all others:

i) Edit the csf.conf file:
vi /etc/csf/csf.conf

Remove port 21 from:
# Allow incoming TCP ports


Remove port 21 from:
# Allow outgoing TCP ports

Save the file.

ii) Edit the csf.allow file:
vi /etc/csf/csf.allow

Add this entry:
tcp:in:d=21:s=10.10.10.10

Save the file and restart CSF:
csf -r


Conclusion
By following these steps, you can secure your server by blocking FTP access entirely, restricting it to specific IPs, or allowing FTP access only for trusted sources. Always test firewall rules to avoid accidental lockouts and ensure smooth server operation.




By admin