Ftp server behind pfsense passive transfer problem

[dav63]

Hi,

I am using pfsense 2.0.1-RELEASE (amd64) built on Mon Dec 12 18:43:51 EST 2011 FreeBSD 8.1-RELEASE-p6

I have a CentOS ftp server using proftpd service behind pfsense firewall. Pfsense ftp setup is as indicated in Option 1 of pfsense ftp guide with proxy helper set to default value in kernel.

Using filezilla in Active Mode everything is fine, using in passive mode it works but sometimes there is a server disconnection from server and RETR or MLSD commands fail:

Error : connection time expired
Error:         transfer failed

from the server side the relevant processes are not completing the transfer and expire after the connection timeout. The destination ip address of proftpd processes is the filezilla client public one.

I tested the file transfer with IPSec VPN connection and it works in both active and passive modes, so I can exclude any proftpd issue.

Please can you help me finding the issue?

[dav63]

Hi,

I have fixed the issue:

1. Added NAT Outbound Rule for port forwarding with range for passive ftp, I defined same range in  proftpd server configuration file (50000 - 60000)
2. Disabled proxy ftp helper from kernel

now it works perfectly!

Thxs for help!

[Hemant]

How do you forward FTP port for public IP??

[dav63]

I forward port 20 (data) and 21 with NAT rules from Wan interface to the lan ip address of ftp server

[Hemant]

Which version of pfsense you ?
I open 20 and 21 port but it still having problem.
actually i can log in but
I have flowing error

Status: Connection established, waiting for welcome message…
Response: 220 ProFTPD 1.3.4a Server (my.freenas.com FTP Server) [192.168.2.105]
Command: USER PravinI
Response: 331 Password required for PravinI
Command: PASS *******
Response: 230-Welcome to my FTP…test ftp
Response: 230 User PravinI logged in
Command: OPTS UTF8 ON
Response: 200 UTF8 set to on
Status: Connected
Status: Retrieving directory listing...
Command: PWD
Response: 257 "/mnt/Datacenter" is the current directory
Command: TYPE I
Response: 200 Type set to I
Command: PASV
Response: 227 Entering Passive Mode (192,168,2,105,22,34).
Status: Server sent passive reply with unroutable address. Passive mode failed.
Command: PORT 192,168,2,207,41,66
Response: 500 Illegal PORT command
Error: Failed to retrieve directory listing
Status: Disconnected from server

[johnpoz]

"I forward port 20 (data)"

So clearly you don't understand the basics of how the ftp protocol works in the first place.

In what scenario with a ftp server behind pfsense and someone accessing it from the public side would unsolicited traffic inbound to pfsense wan have a dest port of 20??

Never is when.

I highly suggest you understand how ftp works before you go forwarding ports.

http://slacksite.com/other/ftp.html

@hemat your connecting to a Private IP there 192.168.2.105, and your using passive so the server told you to connect to 192.168.2.105 at port 22*256 + 34, look like your client said screw that thats not a routable address – which is correct since its private.  And then port command that told the server to connect back to itself at 192.168.2.207 -- so where do you think you need to have any firewall rules here.. Look to me like yoru client and ftp server are on the same network.. How would pfsense even come into play?

[Hemant]

Hi;
thanks for link.
i attached two screenshot; can you have any idea where i wrong?
I can use FreeNAS for ftp and PFsense is the Firewall.

[johnpoz]

And again hemant – how does pfsense even come into play??  Your box is on the same network as the ftp server from the ips listed - pfsense would not even be in the conversation between two boxes on the same segment.  From your posted ftp session it looks like 192.168.2.207 is talking to server on 192.168.2.105..  Why would pfsense be involved in that conversation?

But from your rules there - you have MULTIPLE pubic IPs?  So say I come in public IP A, now when my ftp server goes to make the connection back to the client..  What public IP will I use, maybe its B?  If so the client would normally tell me to F off..  Since his ftp helper and just normal nat would expect the traffic from the same ip it talked to for the ftp server address.

Also the ftp helper when used will change the IP to public, if your going to turn off the helper than you need to make sure that the ftp server returns its public IP..  Same goes for the client in a active connection.

Again understanding the protocol is the first step - and understanding if your even using your firewall is step 2?  Look at your conversation you posted..  Where is pfsense involved in that conversation between 2 boxes on the same segment?  Did you use nat reflection to access the server, ie via your public IP and you have the helper off so it returned the Private IP in the banner?  Don't test port forwards using nat relection..  Get someone from outside your network to test - if you send me info, I would be happy to test your ftp server for you.

[boohoo]

@dav63:

Hi,

I have fixed the issue:

1. Added NAT Outbound Rule for port forwarding with range for passive ftp, I defined same range in  proftpd server configuration file (50000 - 60000)
2. Disabled proxy ftp helper from kernel

now it works perfectly!

Thxs for help!

It worked in the beginning but did some changes and I can never get it to work again.

Fowards range from 2000-2020 > ftp server port 2000

ftp server listen on port 2000 and passive is 2000-2020
I also have set debug.pfftpproxy = 1

version of pfsense
2.0.3-RELEASE (amd64)
built on Fri Apr 12 10:27:56 EDT 2013
FreeBSD 8.1-RELEASE-p13
Can't get it work.

EDIT…. it seems that when I did an update it was corrupted.. did a fresh install it was good to go.