Windows – FTP “425 Can’t open data connection” only happens when using command prompt

on a vsftpd server within CentOS 7 there was an error 425 sometimes

ftp.exe from Windows Legacy (2000, XP, 7) support only active ftp (ports 21,20) ftp.exe from Windows 10 does work with passive mode. this vsftpd server was configured to support both active and passive modes it had both lines at /etc/vsftpd/vsftpd.conf:

connect_from_port_20=YES
pasv_enable=YES

but, Windows 10, and others, sometimes did login and were able to transfer, sometimes they did not, with error 425; this was not a NAT, router or firewall problem; as one can find searching the Internet, it was a security policy by SELinux.

the solution:

setsebool -P ftpd_connect_all_unreserved 1

FTP has a control connection and a data connection. The control connection is started from the client to the server and thus makes usually no problems, but the data connections are different:

• in active mode the server tries to connect to the client. The necessary IP and port setting are send within the PORT or EPRT command inide the control channel. If the client is behind active mode will not work, because the client uses an IP address not reachable by the server. Similar problems are if the client is behind a firewall, because connections from outside will simply be blocked. Only FTP aware firewalls might employ special helpers to manage active connections (and these will not work with FTPS).
• in passive mode the client connects to the server. The necessary IP and port are send within the response to the PASV or EPSV commands. There are no problems with NAT on the client side and usually no problems with firewalls either. But there will be problems if the server itself is behind firewall or NAT.

In short: Passive mode works most of the time, while active mode works only if the client has a public address. But this is not the case for clients behind a router (at home, public hotspot...) and usually also not in mobile networks.