FTP access from WAN

micro80

Hello
I have created a NAT forwarding tru the firewall to a specific IP address on my LAN.
I can establish connection but I get error in the FTP program.
Rules is like this:

Rules:
TCP/UDP * * WAN address 21 (FTP) * NAT WAN to WAN FTP

NAT rules:
TCP/UDP * * 172.16.10.100 21 (FTP) * NAT WAN to WAN FTP
TCP/UDP * * WAN address 21 (FTP) * NAT WAN to WAN FTP

The error Message I get is:
Status: Finner IP-adresse for mikkel.gotdns.com
Status: Kobler til 81.166.107.132:21…
Status: Tilkoblet, venter på velkomstmelding...
Respons: 220 Gene6 FTP Server v3.10.0 (Build 2) ready...
Kommando: USER mikkel
Respons: 331 Password required for mikkel.
Kommando: PASS *********
Respons: 230 User mikkel logged in.
Kommando: CLNT FileZilla
Respons: 200 Noted.
Kommando: OPTS UTF8 ON
Respons: 200 UTF8 OPTS ON
Status: Tilkoblet
Status: Mottar mappeliste...
Kommando: PWD
Respons: 257 "/" is current directory.
Kommando: TYPE I
Respons: 200 Type set to I.
Kommando: PASV
Feil: Koblet fra serveren: ECONNABORTED - Connection aborted
Feil: Feil ved mottakelse av mappelisten

What is wrong and how can I fix it?
If I skip the step in the network setup with pfSense firewall its works just fine.

brcisna

micro80,

you did not mention which version of pfSense you are using?
what os and version of ftp server are you using?
i run into the exact problem you have explained with a 64-bit version of centos 5 running vsftp server. but, the 4 other 32 bit versions of vsftp server(s) worked as expected. (these were all the same version vsftp, for posterity)
,, this is pfSense-1.2.3-RELEASE
i only guessed that something in the 64 bit kernel had different conntrak modules that simply couldn't traverse the pfSense box's nat .
i could get 'one way' connection', telnet for example but never could see files reliably. i finally gave up after quite a bit of tcpdumps,,etc.
is your os, by chance 64 bit?

b

micro80

I run 1.2.3-RELEASE
I did find the solution and its to run FTP like active and not passive transfer modus.
Its very bad but I dont know any solution to skip this problem.
I want to skip it because now I have problem to connect with windows FTP built in client.

Anyone have a solution?

marvosa

Dump your rules and start over. Assuming your FTP server's IP is 172.16.10.100, change the default port to something non standard like 7431, create the following NAT Port Forward:

Interface - WAN
External address - any
Protocol - TCP
External Port Range (from) - 7431
External Port Range (to) - leave blank
NAT IP - 172.16.10.100
Local Port - 7431
Description - FTP Server
Check the box for "Auto-add a firewall rule to permit traffic through this NAT rule"

You now need to enable PASV mode on your FTP server, enter the External (Public) IP for your network and configure a PASV port range… e.g. 30000-30200 (need at least 1 port for every connected FTP user).

Create another NAT port forward for that PASV port range to your FTP server:

Interface - WAN
External address - any
Protocol - TCP
External Port Range (from) - 30000
External Port Range (to) - 30200
NAT IP - 172.16.10.100
Local Port - 30000
Description - FTP Passive Ports
Check the box for "Auto-add a firewall rule to permit traffic through this NAT rule"

Save, Apply, Done.