Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    FTP Proxy / Nat dependency Bug

    Scheduled Pinned Locked Moved
    NAT
    4
    29
    9.9k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      timb0311
      last edited by

      The fix quits working after 4-5 days anyway… proxy shuts down.

      If the loopback has nothing to do with it then why the rules with the loopback address for the dmz (sis2) and lan (sis1) interfaces for ftp traffic:

      $ pfctl -s rules | grep ftp
      anchor "ftpsesame/" all
      pass in quick on sis2 inet proto tcp from any to 127.0.0.1 port = ftp keep state label "FTP PROXY: Allow traffic to localhost"
      anchor "ftpproxy" all
      anchor "pftpx/      " all
      pass in quick on sis1 inet proto tcp from any to 127.0.0.1 port = ftp-proxy keep state label "FTP PROXY: Allow traffic to localhost"
      pass in quick on sis1 inet proto tcp from any to 127.0.0.1 port = ftp keep state label "FTP PROXY: Allow traffic to localhost"
      pass in quick on sis0 inet proto tcp from any port = ftp-data to (sis0) port > 49000 user = 62 flags S/SA keep state label "FTP PROXY: PASV mode data connection"
      pass in quick on sis0 inet proto tcp from any to 10.0.x.180 port = ftp keep state label "USER_RULE: NAT WAN --> FTP Server"
      pass in quick on sis0 proto tcp from any to any port = ftp flags S/SA keep state label "USER_RULE: NAT WAN --> FTP Server"

      Another thing that doesn't make sense with your explanation.  The firewall NAT setup to forward from wan to dmz host on port 21.  Then you have the ftp proxy listening on the wan and forwarding to the dmz host on port 21.  Seems like a conflict to me.

      I would still like you to post or email a working xml config.  If you say you have a working config then you wiill not mind sharing.  And there must be something not the same in our configs.

      1 Reply Last reply Reply Quote 0
      • S
        sullrich
        last edited by

        @timb0311:

        The fix quits working after 4-5 days anyway… proxy shuts down.

        If the loopback has nothing to do with it then why the rules with the loopback address for the dmz (sis2) and lan (sis1) interfaces for ftp traffic:

        $ pfctl -s rules | grep ftp
        anchor "ftpsesame/" all
        pass in quick on sis2 inet proto tcp from any to 127.0.0.1 port = ftp keep state label "FTP PROXY: Allow traffic to localhost"
        anchor "ftpproxy" all
        anchor "pftpx/        " all
        pass in quick on sis1 inet proto tcp from any to 127.0.0.1 port = ftp-proxy keep state label "FTP PROXY: Allow traffic to localhost"
        pass in quick on sis1 inet proto tcp from any to 127.0.0.1 port = ftp keep state label "FTP PROXY: Allow traffic to localhost"
        pass in quick on sis0 inet proto tcp from any port = ftp-data to (sis0) port > 49000 user = 62 flags S/SA keep state label "FTP PROXY: PASV mode data connection"
        pass in quick on sis0 inet proto tcp from any to 10.0.x.180 port = ftp keep state label "USER_RULE: NAT WAN --> FTP Server"
        pass in quick on sis0 proto tcp from any to any port = ftp flags S/SA keep state label "USER_RULE: NAT WAN --> FTP Server"

        These are OUTGOING FTP.  LAN -> WAN.  Nothing to do with WAN -> LAN.  The last 2 allow the traffic that has been rdr'd by the pftpx helper.

        @timb0311:

        Another thing that doesn't make sense with your explanation.  The firewall NAT setup to forward from wan to dmz host on port 21.  Then you have the ftp proxy listening on the wan and forwarding to the dmz host on port 21.  Seems like a conflict to me.

        Read the pftpx code before you make these accusations, please.

        @timb0311:

        I would still like you to post or email a working xml config.  If you say you have a working config then you wiill not mind sharing.  And there must be something not the same in our configs.

        I will set it up one more time and send config.xml but this is a complete waste of my time quite frankly, I've already spent 7+ hours on this issue for you.

        1 Reply Last reply Reply Quote 0
        • H
          hoba
          last edited by

          Not counting my time  ;)

          And I described you my setup in detail starting from a vanilla install. There is no special mystique config that you need. Few simple steps I described and it works.

          1 Reply Last reply Reply Quote 0
          • S
            sullrich
            last edited by

            Okay, here's the config.xml.  I initially forgot that interfaces -> wan disable ftp helper was not checked and panic'd but after that it sprung to life as it should have:

            <pfsense><version>2.3</version>
            <lastchange><theme>metallic</theme>
            <system><optimization>normal</optimization>
            <hostname>pfSense</hostname>
            <domain>local</domain>
            <dnsserver><dnsallowoverride><username>admin</username>
            <password>$1$dSJImFph$GvZ7.1UbuWu.Yb8etC0re.</password>
            <timezone>Etc/UTC</timezone>
            <time-update-interval>300</time-update-interval>
            <timeservers>pool.ntp.org</timeservers>
            <webgui><protocol>http</protocol>
            <certificate><private-key></private-key></certificate></webgui>
            <disablenatreflection>yes</disablenatreflection>
            <enablesshd>yes</enablesshd>

            <maximumstates></maximumstates></dnsallowoverride></dnsserver></system>
            <interfaces><lan><if>le0</if>
            <ipaddr>192.168.1.1</ipaddr>
            <subnet>24</subnet>
            <media><mediaopt><bandwidth>100</bandwidth>
            <bandwidthtype>Mb</bandwidthtype></mediaopt></media></lan>
            <wan><if>le1</if>
            <mtu><media><mediaopt><bandwidth>100</bandwidth>
            <bandwidthtype>Mb</bandwidthtype>
            <spoofmac><ipaddr>dhcp</ipaddr>
            <dhcphostname></dhcphostname></spoofmac></mediaopt></media></mtu></wan></interfaces>
            <staticroutes><pppoe><pptp><bigpond><dyndns><type>dyndns</type>
            <username><password></password></username></dyndns>
            <dhcpd><lan><enable><range><from>192.168.1.100</from>
            <to>192.168.1.199</to></range></enable></lan></dhcpd>
            <pptpd><mode><redir><localip></localip></redir></mode></pptpd>
            <ovpn><dnsmasq><enable></enable></dnsmasq>
            <snmpd><syslocation><syscontact><rocommunity>public</rocommunity></syscontact></syslocation></snmpd>
            <diag><ipv6nat></ipv6nat></diag>
            <bridge><syslog><nat><ipsecpassthru><enable></enable></ipsecpassthru>
            <rule><protocol>tcp</protocol>
            <external-port>21</external-port>
            <target>192.168.1.69</target>
            <local-port>21</local-port>
            <interface>wan</interface>
            <descr>FTP</descr></rule></nat>
            <filter><rule><type>pass</type>
            <descr>Default LAN -> any</descr>
            <interface>lan</interface>
            <source>
            <network>lan</network>

            <destination><any></any></destination></rule>
            <rule><interface>wan</interface>
            <protocol>tcp</protocol>
            <source>
            <any><destination><address>192.168.1.69</address>

            <port>21</port></destination>
            <descr>NAT FTP</descr></any></rule>
            <rule><interface>wan</interface>
            <protocol>tcp</protocol>
            <source>
            <any><destination><network>wanip</network>
            <port>21</port></destination>
            <descr>NAT FTP</descr></any></rule></filter>
            <ipsec><preferredoldsa></preferredoldsa></ipsec>
            <aliases><proxyarp><wol><installedpackages><revision><description>/interfaces_wan.php made unknown change</description>
            <time>1157493006</time></revision></installedpackages></wol></proxyarp></aliases></syslog></bridge></ovpn></bigpond></pptp></pppoe></staticroutes></lastchange></pfsense>

            1 Reply Last reply Reply Quote 0
            • T
              timb0311
              last edited by

              Ok good, here is the problem.  After comparing configs, which we should have done a long time ago.  Would have saved us both lots of testing hours.

              <disablenatreflection>yes</disablenatreflection> which maps to System > Advanced > Disable NAT Reflection > checked.

              I had this unchecked, so I could access our websites running on the dmz from the lan using their public dns names.  With this unchecked this causes the problem with the ftp.  With it checked works fine.

              So my next question is how can I get these to work together so I can access the websites from the lan?

              1 Reply Last reply Reply Quote 0
              • S
                sullrich
                last edited by

                Interesting.  I suppose we will want to ignore reflection entries for port 21.  I will check into it.

                1 Reply Last reply Reply Quote 0
                • T
                  timb0311
                  last edited by

                  Ok let me know what you find out.

                  1 Reply Last reply Reply Quote 0
                  • S
                    sullrich
                    last edited by

                    Please replace /etc/inc/filter.inc with http://www.pfsense.com/~sullrich/filter.inc using diagnostics -> edit file.

                    Then run /etc/rc.filter_configure from diagnostics -> command prompt

                    Hopefully the reflection entries for port 21 will be gone now.

                    1 Reply Last reply Reply Quote 0
                    • T
                      timb0311
                      last edited by

                      That seemed to fix it.

                      1 Reply Last reply Reply Quote 0
                      • S
                        sullrich
                        last edited by

                        Yay!

                        I'll commit.  Thanks for testing.

                        1 Reply Last reply Reply Quote 0
                        • R
                          rsw686
                          last edited by

                          Thanks for fixing this!! I also had problems with FTP previously and had disable nat reflection unchecked. After replacing filter.inc ftp works. timb0311 good catch about the nat reflection.

                          When you say you committed it, I am assuming this will be included in the next release after RC2i.

                          1 Reply Last reply Reply Quote 0
                          • H
                            hoba
                            last edited by

                            It already is included in the latest snapshots: http://pfsense.com/~sullrich/1.0-SNAPSHOT-09-07-06/

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post