Главная

в /etc/sysconfig/iptables-config:
IPTABLES_MODULES="nf_conntrack_ftp nf_conntrack"

в /etc/sysconfig/iptables:

# FTP passive mode

-A INPUT -p tcp -m tcp --dport 21 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT

-A INPUT -p tcp -m tcp --dport 20 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT

-A INPUT -p tcp -m tcp --sport 1024:65535 --dport 20:65535 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT

-A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT

-A INPUT -j REJECT --reject-with icmp-port-unreachable

-A OUTPUT -p tcp -m tcp --dport 21 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT

-A OUTPUT -p tcp -m tcp --dport 20 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT

-A OUTPUT -p tcp -m tcp --sport 1024:65535 --dport 20:65535 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT

в /etc/vsftpd/vsftpd.conf:
anonymous_enable=NO
chroot_local_user=YES
listen_ipv6=NO
pasv_enable=yes
pasv_min_port=5000
pasv_max_port=5100

TLS:
https://www.digitalocean.com/community/tutorials/how-to-configure-vsftpd-to-use-ssl-tls-on-a-centos-vps