Pure-FTPD Pure-FTPD timeout when trying to access from ipV6 public ip?

Does the Centmin Mod server even support IPv6 or is it IPv4 only? AFAUK, Pure-ftpd by default listens for both IPv4 and IPv6 connections (provided server is setup to support IPv6). You can check what pure-ftpd addresses are being listened on via command

Code (Text):

netstat -plantu | grep -i pure

example shows both IPv6 and IPv4 TCP/TCP6 port listeners

Code (Text):

netstat -plantu | grep -i pure
tcp        0      0 0.0.0.0:21              0.0.0.0:*               LISTEN      4159345/pure-ftpd   
tcp6       0      0 :::21                   :::*                    LISTEN      4159345/pure-ftpd

Ensure pure-ftpd passive port range is in TCP_IN and TCP6_IN comma separated list of allowed incoming TCP ports for 30001:50011 range and port 21 for passive port by checking CSF Firewall's /etc/csf/csf.conf config file using egrep

Code (Text):

egrep '^TCP_|^TCP6_|^UDP_|^UDP6_' /etc/csf/csf.conf

You can check if IPv6 IP address you're connecting from is blocked in CSF Firewall using csf grep

Code (Text):

csf -g YOUR_IP_ADDRESS

tried pure-ftpd service restart?

Code (Text):

systemctl restart pure-ftpd

You can see settings for Filezilla config at Pure-FTPD Virtual FTP Users - CentminMod.com LEMP Nginx web stack for CentOS. But does this work on IPv4 and IPv6 connecting IPs from either of your locations?

 

you're missing 30001:50011 pure-ftpd passive port ranges in TCP_IN and TCP6_IN comma separated lists

Code (Text):

TCP_IN = "20,21,78,25,53,853,80,110,143,443,465,587,993,995,30001:50011"
TCP6_IN = "20,21,78,25,53,853,80,110,143,443,465,587,993,995,30001:50011"

if you check the working servers /etc/csf/csf.conf egrep check, do you see 30001:50011 ? If so, on problematic server re-add 30001:50011 to comma separated list for TCP_IN and TCP6_IN and restart CSF Firewall

Code (Text):

csf -ra

edit: just noticed port 78 there, so you changed SSHD port via centmin.sh menu option 16 right?

edit: so looks like you came across a bug in Centmin Mod's initial CSF Firewall install and configure routine due to changes in CSF Firewall's default TCP_IN and TCP6_IN port list adding a port 853 to the list so Centmin Mod CSF Firewall routine wasn't expecting the 853 port in the list of ports that triggers adding Centmin Mod required ports like pure-ftpd passive port range

Centmin Mod expected CSF Firewall defaults to be

Code (Text):

20,21,22,25,53,80,110,143,443,465,587,993,995

but new defaults are with 853 added

Code (Text):

20,21,22,25,53,853,80,110,143,443,465,587,993,995

so Centmin Mod initial install didn't add it's ports including 30001:50011

FYI, port 853 is used for DNS over TLS (DoT).

CSF Firewall added port 853 in v14.18 - current version is v14.19 https://download.configserver.com/csf/changelog.txt

Code (Text):

ChangeLog:

14.19 - Switch to using iptables-nft if it exists in /usr/sbin/iptables-nft

        Added IO::Handle::clearerr() call before reading data from a log file

    Added "Require all granted" to the MESSENGER .htaccess file

    Added UID/GID rules to IPv6 if enabled

    Modified dovecot regex to look for "failed: Connection reset by peer"

14.18 - Added port 853 for DoT to all new installs

        Added exe wpt-panopticon on cPanel servers to csf.pignore

    Updated list of EOL PHP versions
   
    Modified HTACCESS regex to include "remote" as well as "client" log
    lines

    Implemented DA POST workaround for saving large text files via the UI

    Modified MESSENGER to only send unblock email if a valid IP is
    requested

    Modified DA server check to look for multiple php versions in
    /usr/local/php*

 

FYI, I just updated Centmin Mod 124.00stable and 130.00beta01 with a fix for missing pure-ftpd passive port range config in CSF Firewall due to CSF v14.18 default changes which came out ~August 18, 2023. You can run cmupdate command on your Centmin Mod install to update the code and then run and exit centmin.sh menu once to auto apply the fix and then run command

Code (Text):

egrep '^TCP_|^TCP6_|^UDP_|^UDP6_' /etc/csf/csf.conf

to check if TCP_IN and TCP6_IN now show in comma separated list of whitelisted ports the pure-ftpd passive port range entry = 30001:50011

 

did you run centmin.sh and exit once after cmupdate? You need to run centmin.sh once to apply the fix

try removing manually added 30001:50011 entry and then run cmupdate command again and see.

or check the last update made via these commands

Code (Text):

cmdir
git log -1 | grep -v Author

which should show

Code (Text):

git log -1 | grep -v Author
commit baaa1dcc13590a7b0537a3528e7e379171f2cd8b
Date:   Thu Aug 24 20:17:02 2023 +1000
    chmod +x tools/fix-csf-ftp-ports.sh in 130.00beta01

thanks for confirmation