Is ftp nat broken on 2.2 ?
-
Hello to everyone,
Somebody has experimented trouble with ftp server (but also client on lan) behind pfsense, after upgrading to 2.2 (amd64 version)?
In my case, my ftp server, has stopped to work in passive mode (could be proxy ftp module ? ) and also a setting of "System Tunables", debug.pfftpproxy=1, doesn't make differences
The only way to make it work, is to set as active mode.
While for ftp clients on lan, I have not yet a reasonable solution… the only way is to open all port (and not only 20-21), but it is not so acceptable.
Thanks a lot in advance for any suggestion -
The ftp helper/proxy is not included in in 2.2..
-
Hello, and another option to have an ftp server behind a Pfsense 2.2 ???
-
I had the clients install openvpn and passed only the /31 that the ftp server is running on. Works.
-
If you want to run ftp behind pfsense without a helper and allow for passive, then do it old school and manually forward the passive ports your going to use. And make sure your ftp server provides its public IP. Done and done, but I would take the opportunity to move to something more secure like sftp.
-
It didn't work for me. Forwarded the ports, set the external IP. I could log in but wasn't getting the directories.
I'm pretty good at forwarding a port, so something else is required on my network other than just forwarding ports.
And lots of other people had at it before they called me.
-
Well what ports did you forward.. If a client is is going passive to your server. You have to forward the ports the server is going to use for its passive connections. So normally you set your server to use a specific range say 5000-6000. And then forward those ports.
When you say you were logging in - you were external and not trying to do nat reflection?
-
Everything is correct. 5000-6000 were forwarded. For me, this is a solved problem. Having them do business as usual while using a vpn works fine and is more secure.
I really think the problem is because we don't get our IPs via a bridge. It comes via NAT 1:1 and I feel NAT is the issue.
-
The issue is, the FTP server is reporting the NATed IP instead of the public one, and the client tries to talk to that unroutable NATed IP. This indeed can be fixed by properly configuring the FTP server as documented by the wiki article, or by using a VPN so that the client is actually able to talk to the RFC1918 IP, instead of sending packets to a blackhole.
-
^That would be my guess as well, which I thought was quite clearly stated with "And make sure your ftp server provides its public IP."
-
It provides its public IP. There are only two blanks related to that. Port range and public IP. Kinda hard to get wrong.
Still, its not working - I'm not worried about it.
-
So lets see a log of the connection. I can tell for fact that this works - because have done it.. What ftp server are you using?
edit: Here see attached so this is the ftp server showing that it sends the pasv command and port 19*256+137 = 5001
Sure the client supports passive.. Just because you send say quote pasv doesn't mean the client then doesn't send port command.
I wold take a look at the logs to see that passive and correct IPs and port actually sent.
-
Windows server. (its highly possible that firewall is the issue) Forwarding a port is simple. Been checked.
I'm not going to spin my wheels with it. Everything else that relies on port forwards was unaffected.
I hate running windows server to be honest and I told my partner that if he insisted on it that all the problems fall on him.
Not gonna mess with it. I fixed the issue on my end. -
Your solution is clearly more secure.. But this old school method works as well - if not your doing something wrong ;)