Allow vsftpv pasv ports in firewalld on CentOS 7 (RHEL7)

Although quite a few pages say that you can get vsftpd pasv support by just adding the ftp service to the new firewall daemon (firewalld) on CentOS 7, that has not been my experience at all, at least not when using FileZilla on Windows as the client.  For some reason, the built-in ftp service does not really track the ports and connections 100%.  It was flakey at best.

To solve this, I created a new service called ftp_pasv for my pasv port range, and then granted access to both the built-in ftp service plus my ftp_pasv service.  That gave me 100% success -- reading directory listings, uploading and downloading files.

I added my ftp_pasv.xml file to BOTH locations, /usr/lib/firewalld/services/ and /etc/firewalld/services/.   For a pasv range of 8021-8121, this would be the service definition:

<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>PASV FTP</short>
  <description>additional ports required for PASV ftp</description>
  <port protocol="tcp" port="8021-8121"/>
</service>

IMPORTANT: after creating the file, reload to have it added to the list of available services.

firewall-cmd --reload

firewall-cmd --get-services

I tested the validity of the file with

firewall-cmd --add-service=ftp_pasv

and to make the change permanent,

firewall-cmd --permanent --add-service=ftp_pasv

I did not find any examples where one service could open two port ranges, i.e. 20-21 plus 8021-8121, so I made use of the built-in ftp service PLUS my extra ftp_pasv service. Everything else goes according to the usual docs in terms of granting access to the service for a particular zone, etc. etc.

How Wide Should the Range of Pasv Ports Be?

Each simultaneous user will use up at least one port, and there is a delay before they are available to another person. Furthermore, some ftp clients open multiple channels in parallel and can use up 10 or more ports at a time.  FileZilla on Windows is a client that opens multiple in parallel, and, you can configure it to use fewer ports.  Menu: File > Site Manager > Transfer Settings [tab], then [x] Limit number of simultaneous connections. Try 2. 

Docs for vsftpd talk about using a port range from 10000-20000 or even 1024-65535. Whether you want to open that many ports is up to you.