{"id":174,"date":"2025-03-27T09:45:33","date_gmt":"2025-03-27T07:45:33","guid":{"rendered":"https:\/\/www.24x7serverguard.com\/blog\/?p=174"},"modified":"2025-03-27T09:45:33","modified_gmt":"2025-03-27T07:45:33","slug":"how-to-block-ftp-access-using-iptables-and-csf-firewall","status":"publish","type":"post","link":"https:\/\/www.24x7serverguard.com\/blog\/ftp-issues\/how-to-block-ftp-access-using-iptables-and-csf-firewall\/","title":{"rendered":"How to Block FTP Access Using IPTables and CSF Firewall"},"content":{"rendered":"\n

Securing your server by restricting FTP access is essential for preventing unauthorized access. Here\u2019s how you can block FTP (port 21) using IPTables (default system firewall)<\/strong> and CSF (ConfigServer Security & Firewall)<\/strong>.<\/p>\n\n\n\n

<\/p>\n\n\n\n

Block FTP Access Using IPTables<\/strong><\/h2>\n\n\n\n

1. Completely Disable FTP Access
To block all FTP connections on the server, run:<\/strong><\/h4>\n\n\n\n

iptables -A INPUT -p tcp –dport 21 -j DROP<\/mark><\/p>\n\n\n\n

2. Block FTP Access for a Specific IP
<\/strong><\/p>\n\n\n\n

If you want to deny FTP access for a specific IP (e.g., 10.10.10.10), use:<\/p>\n\n\n\n

iptables -A INPUT -p tcp -s 10.10.10.10 --dport 21 -j DROP<\/mark>

3. Block FTP Access for a Subnet
<\/strong>
<\/mark><\/pre>\n\n\n\n
To block FTP access for an entire subnet (e.g., 10.10.10.0\/24), use:<\/p>\n\n\n\n
iptables -I INPUT -p tcp -s 10.10.10.0\/24 --dport 21 -j DROP<\/mark>

4. Save and Apply IPTables Rules<\/strong>
After adding the rules, save them:

\/etc\/init.d\/iptables save
<\/mark>
Then restart IPTables to apply changes:

\/etc\/init.d\/iptables restart
<\/mark>

<\/strong>
<\/mark>Block FTP Access Using CSF Firewall
<\/strong><\/pre>\n\n\n\n
1. Completely Disable FTP Access<\/strong>
Edit the CSF configuration file:<\/p>\n\n\n\n
vi \/etc\/csf\/csf.conf<\/mark><\/p>\n\n\n\n
Find the line:<\/p>\n\n\n\n
# Allow incoming TCP ports
TCP_IN =<\/mark>
<\/pre>\n\n\n\n
Remove port 21<\/code> from the list, save the file, and restart CSF:<\/p>\n\n\n\n
csf -r
<\/mark>
2. Block FTP Access for a Specific IP<\/strong>
Edit the csf.deny file:

vi \/etc\/csf\/csf.deny
<\/mark>
Add the following line:
tcp:in:d=21:s=10.10.10.10
<\/mark>
Save the file and restart CSF:
csf -r<\/mark>

3. Allow FTP Access for a Specific IP and Deny All Others
<\/strong>
<\/mark>To allow FTP for a specific IP while blocking all others:

i) Edit the csf.conf file:
vi \/etc\/csf\/csf.conf
<\/mark>
Remove port 21 from:
# Allow incoming TCP ports
<\/mark>

Remove port 21 from:
# Allow outgoing TCP ports
<\/mark>
Save the file.

ii) Edit the csf.allow file:
vi \/etc\/csf\/csf.allow
<\/mark>
Add this entry:
tcp:in:d=21:s=10.10.10.10<\/mark>

Save the file and restart CSF:
csf -r<\/mark>


Conclusion<\/strong>
By following these steps, you can secure your server by blocking FTP access entirely, restricting it to specific IPs, or allowing FTP access only for trusted sources. Always test firewall rules to avoid accidental lockouts and ensure smooth server operation.

<\/mark>


<\/strong><\/pre>\n","protected":false},"excerpt":{"rendered":"
Securing your server by restricting FTP access is essential for preventing unauthorized access. Here\u2019s how you can block FTP (port 21) using IPTables (default system firewall) and CSF (ConfigServer Security & Firewall). Block FTP Access Using IPTables 1. Completely Disable FTP AccessTo block all FTP connections on the server, run: iptables -A INPUT -p tcp […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13],"tags":[114,115,60,117,116],"class_list":["post-174","post","type-post","status-publish","format-standard","hentry","category-ftp-issues","tag-block-ftp-access-using-firewall","tag-dubai","tag-ftp","tag-iptable","tag-server-management"],"_links":{"self":[{"href":"https:\/\/www.24x7serverguard.com\/blog\/wp-json\/wp\/v2\/posts\/174","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.24x7serverguard.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.24x7serverguard.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.24x7serverguard.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.24x7serverguard.com\/blog\/wp-json\/wp\/v2\/comments?post=174"}],"version-history":[{"count":1,"href":"https:\/\/www.24x7serverguard.com\/blog\/wp-json\/wp\/v2\/posts\/174\/revisions"}],"predecessor-version":[{"id":175,"href":"https:\/\/www.24x7serverguard.com\/blog\/wp-json\/wp\/v2\/posts\/174\/revisions\/175"}],"wp:attachment":[{"href":"https:\/\/www.24x7serverguard.com\/blog\/wp-json\/wp\/v2\/media?parent=174"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.24x7serverguard.com\/blog\/wp-json\/wp\/v2\/categories?post=174"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.24x7serverguard.com\/blog\/wp-json\/wp\/v2\/tags?post=174"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}