Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Possible FTP helper bug…

    Scheduled Pinned Locked Moved General pfSense Questions
    17 Posts 2 Posters 10.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      sullrich
      last edited by

      This doesn't really help.  We need to know more information.  We need to know if this is being published to the internet, what site in question, is this a vpn connection, etc.

      Unfortunately your bug report just results in me being more confused.  Please try to outline it a little more.

      1 Reply Last reply Reply Quote 0
      • S
        Superman
        last edited by

        Here's a few snippets. It's not much more than what I explained earlier. I'm not quite sure what other information you need and how to get it. I tried looking in the logs, but there's just nothing there. I uses ps on both and determined that pftpx is running for sure. What else can I do to get you more information?

        Examples.
        Behind 1.0-SNAPSHOT-09-06-06 (This connection is running Cable Internet using DHCP):

        # ftp ftp.freebsd.org
Trying 204.152.184.73...
Connected to ftp.freebsd.org (204.152.184.73).
220 Welcome to freebsd.isc.org.
Name (ftp.freebsd.org:root): anonymous
530 Please login with USER and PASS.
SSL not available
331 Please specify the password.
Password:
230-
230-You have reached the freebsd.isc.org FTP server, serving the
230-full FreeBSD FTP archive over IPv4 (204.152.184.73) and IPv6
230-(2001:4f8:0:2::e) networks.  This server is also known as:
230-
230-    ftp.freebsd.org
230-    ftp4.freebsd.org
230-    ftp4.us.freebsd.org
230-
230-This server is operated by Internet Systems Consortium (ISC),
230-on behalf of the FreeBSD Project, with hardware donations from
230-Apple, Intel and Iron Systems.
230-
230-Questions about this service can be sent to: freebsd@isc.org.
230-
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
500 Illegal PORT command.
ftp: bind: Address already in use
ftp> passive
Passive mode on.
ftp> ls
227 Entering Passive Mode (204,152,184,73,228,157)
150 Here comes the directory listing.
drwxrwxr-x    3 0        0             512 Apr 17  2003 pub
226 Directory send OK.
ftp> 

        # ps wwaux | grep pftpx
proxy    558  0.0  0.3   656   412  ??  Ss   Thu09PM   0:01.45 /usr/local/sbin/pftpx -c 8021 -g 8021 192.168.1.1

        Behind 1.0-SNAPSHOT-09-04-06 (This connection is running ADSL using PPPoE):

        # ftp ftp.freebsd.org
Connected to ftp.freebsd.org.
220 Welcome to freebsd.isc.org.
Name (ftp.freebsd.org:root): anonymous
331 Please specify the password.
Password:
230-
230-You have reached the freebsd.isc.org FTP server, serving the
230-full FreeBSD FTP archive over IPv4 (204.152.184.73) and IPv6
230-(2001:4f8:0:2::e) networks.  This server is also known as:
230-
230-    ftp.freebsd.org
230-    ftp4.freebsd.org
230-    ftp4.us.freebsd.org
230-
230-This server is operated by Internet Systems Consortium (ISC),
230-on behalf of the FreeBSD Project, with hardware donations from
230-Apple, Intel and Iron Systems.
230-
230-Questions about this service can be sent to: freebsd@isc.org.
230-
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
200 PORT command successful. Consider using PASV.
150 Here comes the directory listing.
drwxrwxr-x    3 0        0             512 Apr 17  2003 pub
226 Directory send OK.
ftp> 

        # ps wwaux | grep pftpx
proxy    500  0.0  0.2   656   420  ??  Ss   Wed06PM   0:02.92 /usr/local/sbin/pftpx -c 8021 -g 8021 192.168.1.1

        Both system have two interfaces, one WAN, one LAN. LAN is 192.168.1.x/24 on both as well. The other FTP servers I was talking about are private servers connected to the internet through each respective pfSense firewall. All are running PureFTPd, one on FreeBSD, one on Gentoo Linux and the other on Debian Linux. Previous to updating to this snapshot  (1.0-SNAPSHOT-09-06-06) everything "just worked," no matter what mode.

        Both are using these settings:

        pfSense_WAN_FTP.jpg
        pfSense_LAN_FTP.jpg
        pfSense_WAN_FTP.jpg_thumb
        pfSense_LAN_FTP.jpg_thumb
        pfSense_WAN_FTP.jpg_thumb
        pfSense_LAN_FTP.jpg_thumb

        1 Reply Last reply Reply Quote 0
        • S
          Superman
          last edited by

          I just "reflashed" my local pfSense that was running 1.0-SNAPSHOT-09-06-06 to 1.0-SNAPSHOT-09-04-06 (or is that a "flashback" ;) ) and now FTP works in ACTIVE mode.

          # ftp ftp.freebsd.org
Trying 204.152.184.73...
Connected to ftp.freebsd.org (204.152.184.73).
220 Welcome to freebsd.isc.org.
Name (ftp.freebsd.org:root): anonymous
530 Please login with USER and PASS.
SSL not available
331 Please specify the password.
Password:
230-
230-You have reached the freebsd.isc.org FTP server, serving the
230-full FreeBSD FTP archive over IPv4 (204.152.184.73) and IPv6
230-(2001:4f8:0:2::e) networks.  This server is also known as:
230-
230-    ftp.freebsd.org
230-    ftp4.freebsd.org
230-    ftp4.us.freebsd.org
230-
230-This server is operated by Internet Systems Consortium (ISC),
230-on behalf of the FreeBSD Project, with hardware donations from
230-Apple, Intel and Iron Systems.
230-
230-Questions about this service can be sent to: freebsd@isc.org.
230-
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
200 PORT command successful. Consider using PASV.
150 Here comes the directory listing.
drwxrwxr-x    3 0        0             512 Apr 17  2003 pub
226 Directory send OK.
ftp>

          And this now shows in the logs:

          Sep 9 07:30:34 	pftpx[558]: #1 client reset connection
Sep 9 07:30:34 	pftpx[558]: #1 client reset connection

          Beyond changing back to the previous snapshot no other settings were changed.

          1 Reply Last reply Reply Quote 0
          • S
            sullrich
            last edited by

            So now everything is okay?

            1 Reply Last reply Reply Quote 0
            • S
              Superman
              last edited by

              Yes, it all works properly with 1.0-SNAPSHOT-09-04-06.

              Interestingly, as I'm sure you're well aware, in the cvstrac timeline, I count about 4 commits that all reference the FTP helper between the two snapshots. Something  in those changes must be affecting it's operation.

              Thanks again!!

              1 Reply Last reply Reply Quote 0
              • S
                sullrich
                last edited by

                So you are having trouble with VPN + FTP basically?

                1 Reply Last reply Reply Quote 0
                • S
                  Superman
                  last edited by

                  Nope, no VPN involved, just FTP.

                  I did notice that those changes did reference VPN, so it does seem odd that they are affecting just regular FTP over the Internet, so maybe it's not those. But some change between those 2 snapshots is certainly affecting FTP. Sorry I know that is a little vague, but I can't point to anything in particular that could be causing it.

                  Thanks again!

                  1 Reply Last reply Reply Quote 0
                  • S
                    sullrich
                    last edited by

                    Then I really don't know.  We only changed code related to incoming FTP + reflection recently.  Nothing else, unfortunately.

                    Trouble is FTP is working perfectly fine for me outgoing.

                    1 Reply Last reply Reply Quote 0
                    • S
                      Superman
                      last edited by

                      Not sure what client you're using, but I noticed with SmartFTP which I was using it automatically falls back to PASSIVE if ACTIVE doesn't work. So I didn't notice the problem at first. But when I added items to the Queue they wouldn't download, because the queue section doesn't have the fallback feature, and was just trying ACTIVE mode. So then I tested with CLI ftp on Linux, so I could limit the mode to one or the other and then I noticed that for sure ACTIVE mode wasn't working. I confirmed this behind 2 different pfSense firewalls both running the 09-06-06, and that behind a third pfSense box @ 09-04-06 that it worked.

                      All these firewalls have very "stock" settings. Pretty much simply using the stock settings with a few NATed services.

                      1 Reply Last reply Reply Quote 0
                      • S
                        sullrich
                        last edited by

                        Using a FTP client (FreeBSD's):

                        226 Directory send OK.
                        ftp> passive off
                        Passive mode: off; fallback to active mode: off.
                        ftp> get rawrite.exe
                        local: rawrite.exe remote: rawrite.exe
                        200 EPRT command successful. Consider using EPSV.
                        150 Opening BINARY mode data connection for rawrite.exe (36064 bytes).
                        100% || 36064      57.35 KB/s    00:00 ETA
                        226 File send OK.
                        36064 bytes received in 00:00 (47.58 KB/s)
                        ftp> passive on
                        Passive mode: on; fallback to active mode: off.
                        ftp> get rawrite.exe
                        local: rawrite.exe remote: rawrite.exe
                        229 Entering Extended Passive Mode (|||53759|)
                        150 Opening BINARY mode data connection for rawrite.exe (36064 bytes).
                        100% |                        | 36064      71.84 KB/s    00:00 ETA
                        226 File send OK.
                        36064 bytes received in 00:00 (58.50 KB/s)
                        ftp> passive auto
                        Passive mode: on; fallback to active mode: on.
                        ftp> get rawrite.exe
                        local: rawrite.exe remote: rawrite.exe
                        229 Entering Extended Passive Mode (|||59392|)
                        150 Opening BINARY mode data connection for rawrite.exe (36064 bytes).
                        100% |*************************************| 36064      71.25 KB/s    00:00 ETA
                        226 File send OK.
                        36064 bytes received in 00:00 (58.18 KB/s)
                        ftp>

                        1 Reply Last reply Reply Quote 0
                        • S
                          Superman
                          last edited by

                          Well, I don't know what to say. It was certainly a problem on my systems until I went back to the aforementioned snapshot. Strange. I'll try re-updating to the latest snapshot to see if something funny happened the last time. But it seems odd that the same "funny" thing would happen on 2 different machines.

                          Thanks for your attention to this anyway! 8)

                          1 Reply Last reply Reply Quote 0
                          • S
                            Superman
                            last edited by

                            Okay, I reapplied the 09-06-06 snapshot and like clockwork the problem resurfaced. I don't know what it is, but for me FTP ACTIVE mode really doesn't work with this snapshot. :( I'll just go back to 09-04-06 for now…

                            Thanks!

                            1 Reply Last reply Reply Quote 0
                            • S
                              sullrich
                              last edited by

                              Indeed there was a bug, if you did not have a vpn defined, it would not have installed the rule.

                              Issue these commands from a shell to test:

                              /etc/rc.conf_mount_rw
                              fetch -o /etc/inc/ http://www.pfsense.com/~sullrich/filter.inc
                              /etc/rc.filter_configure

                              1 Reply Last reply Reply Quote 0
                              • S
                                Superman
                                last edited by

                                Should I reapply 09-06-06 first??

                                • Oops, duh, since it's not a problem in 04 I guess I should…sorry for the stupid question...off to update and apply! *
                                1 Reply Last reply Reply Quote 0
                                • S
                                  sullrich
                                  last edited by

                                  Yep.

                                  1 Reply Last reply Reply Quote 0
                                  • S
                                    Superman
                                    last edited by

                                    Oops, missed your reply before my edit…

                                    Anyway, reapplied 09-06-06 and then followed your directions and voila!! It works!! Awesome!! You rock!! :D

                                    Thanks!! 8)

                                    1 Reply Last reply Reply Quote 0
                                    • First post
                                      Last post
                                    Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.