DMZ and FTP Out

josh · Nov 16, 2005, 8:46 PM

Hey Guys,

I'm trying to get ftp out working for my DMZ (OPT1). I do have pftpx turned on, and it works great for the LAN, but as for the DMZ, I can't get it running correctly. If I debug on pftpx (pftpx -d D7), any connections from the LAN go through fine, but anything from OPT1 never even gets an initial connection.

My guess is something to do with the firewall rules for the pftpx/ftp proxy or a NAT/firewall rule I'm missing. Any ideas on howto get this working?

Thanks,
-Josh

Jesse7 · Nov 17, 2005, 12:37 AM

I am probably wrong, but might have something to do with the ftp helper option. I red it in another post on here.

billm · Nov 19, 2005, 6:00 PM

@josh:

Hey Guys,

I'm trying to get ftp out working for my DMZ (OPT1). I do have pftpx turned on, and it works great for the LAN, but as for the DMZ, I can't get it running correctly. If I debug on pftpx (pftpx -d D7), any connections from the LAN go through fine, but anything from OPT1 never even gets an initial connection.

My guess is something to do with the firewall rules for the pftpx/ftp proxy or a NAT/firewall rule I'm missing. Any ideas on howto get this working?

Thanks,
-Josh

0.94 was just released, please try that, there are numerous fixes in it. Thanks

–Bill

simonchs · Nov 30, 2005, 5:06 PM

Seems this problem still exist in 0.94.10… I can't FTP out even if I disable the ftp-helper for the DMZ (OPT1)...
And I've got the following stats:
self tcp 127.0.0.1:8022 <- 137.189.91.191:21 <- xx.xx.30.100:40899 CLOSED:SYN_SENT

137.189.91.191 is a anonymous FTP that I connect to, xx.xx.30.100 is my server IP under bridged DMZ

sullrich · Nov 30, 2005, 5:13 PM

@simonchs:

Seems this problem still exist in 0.94.10… I can't FTP out even if I disable the ftp-helper for the DMZ (OPT1)...
And I've got the following stats:
self tcp 127.0.0.1:8022 <- 137.189.91.191:21 <- xx.xx.30.100:40899 CLOSED:SYN_SENT

137.189.91.191 is a anonymous FTP that I connect to, xx.xx.30.100 is my server IP under bridged DMZ

Fixed in 0.95+

simonchs · Nov 30, 2005, 5:38 PM

@sullrich:

@simonchs:

Seems this problem still exist in 0.94.10… I can't FTP out even if I disable the ftp-helper for the DMZ (OPT1)...
And I've got the following stats:
self tcp 127.0.0.1:8022 <- 137.189.91.191:21 <- xx.xx.30.100:40899 CLOSED:SYN_SENT

137.189.91.191 is a anonymous FTP that I connect to, xx.xx.30.100 is my server IP under bridged DMZ

Fixed in 0.95+

I've just tried to disable the ftp-helper for LAN and WAN interface too, but still cannot get this work… is there any other setting I need to do?
Thanks.

sullrich · Nov 30, 2005, 10:06 PM

@simonchs:

@sullrich:

@simonchs:

Seems this problem still exist in 0.94.10… I can't FTP out even if I disable the ftp-helper for the DMZ (OPT1)...
And I've got the following stats:
self tcp 127.0.0.1:8022 <- 137.189.91.191:21 <- xx.xx.30.100:40899 CLOSED:SYN_SENT

137.189.91.191 is a anonymous FTP that I connect to, xx.xx.30.100 is my server IP under bridged DMZ

Fixed in 0.95+

Do you still entries like: self tcp 127.0.0.1:8022 ??

I've just tried to disable the ftp-helper for LAN and WAN interface too, but still cannot get this work… is there any other setting I need to do?
Thanks.

simonchs · Dec 1, 2005, 5:37 PM

yup, I still got the

self tcp 127.0.0.1:8022 <- 137.189.91.191:21 <- xx.xx.30.100:40899    CLOSED:SYN_SENT

in "Diagnostics: Show States" when I FTP out in DMZ server.

sullrich · Dec 1, 2005, 11:46 PM

@simonchs:

yup, I still got the
self tcp 127.0.0.1:8022 <- 137.189.91.191:21 <- xx.xx.30.100:40899    CLOSED:SYN_SENT
in "Diagnostics: Show States" when I FTP out in DMZ server.

Then the FTP helper isn't being deactivated. Did you reboot after making the change?

simonchs · Dec 3, 2005, 8:26 PM

@sullrich:

Then the FTP helper isn't being deactivated. Did you reboot after making the change?

yes, had to reboot both pfsense and the server after made the change.

simonchs · Dec 29, 2005, 3:53 AM

upgraded to BETA-1, and this problem still existing.

hoba · Dec 29, 2005, 10:37 AM

As you upgraded, can you try again with a fresh install and a from scratch recreated config without importing?

simonchs · Jan 16, 2006, 1:37 AM

problem fixed after upgrade to 1.0-PREBETA2-BUG-VALIDATION-EDITION3
thank you! ;D

simonchs · Jan 16, 2006, 2:43 AM

oh no…
the problem haven't come out because the new option "Enable Filtering Bridge" was not checked, if I checked this option, the problem come back...

tcp 127.0.0.1:8022 <- ftp.server.ip:21 <- ip.under.opt1:56357 CLOSED:SYN_SENT
tcp 127.0.0.1:8022 <- ftp.server.ip:21 <- ip.under.opt1:56360 CLOSED:SYN_SENT

sullrich · Jan 16, 2006, 4:18 AM

Add the rules to allow ftp to talk to localhost.