first you must knows FTP Passive mode working principle. ##load ftp track for kernel modprobe ip_conntrack_ftp     echo IPTABLES_MODULES=\"ip_conntrack_ftp\" >> /etc/sysconfig/iptables-config ## permit client request ftp server. iptables -A INPUT -p tcp -i eth0 -m state --state NEW --dport 21 -j ACCEPT

iptables -A INPUT -p tcp -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT ## deny all other traffic, Note you's SSH. iptables -P INPUT DROP ## save the config iptables-save > /etc/sysconfig/iptables ## restart iptables service iptables restart ## is over...