iptables 下的 vsftp ftp: connect: No route to host

iptables
# Firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 110 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 25 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -p UDP -s 0/0 --dport 53 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -s 0/0 --dport 20 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -s 0/0 --sport 20 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -s 0/0 --dport 21 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -s 0/0 --sport 21 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -s 0/0 --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT

登陆信息:
[root@oralce vsftpd]# ftp 192.168.0.203 1221
Connected to 192.168.0.203 (192.168.0.203).
220 (vsFTPd 2.0.1)
Name (192.168.0.203:brenbo): brenbo
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
227 Entering Passive Mode (192,168,0,203,82,178)
ftp: connect: No route to hos

在百度上找了半天也没找到个答案,一想是E文,又在google上找了下.找出了一堆,不过晕了半天才找到些相关的

在/etc/sysconf/iptables-config 文件中
更改 IPTABLES_MODULES="" 为 IPTABLES_MODULES="ip_nat_ftp ip_conntrack_ftp" 那现在OK了.(具体什么意思不懂.)

问题是如果在vsftpd.conf中加入一句listen_port=2121后iptables相关项也改掉问题就又出现了.不解啊.