Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    FTP Port Forwarding Issue

    Scheduled Pinned Locked Moved NAT
    13 Posts 4 Posters 3.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      Pringles
      last edited by

      FTP Port Forwarding Issue

      Hello al
      I am Trying to port ftp in Nat not getting ant look at al can any one help me i have bean  reading a lot about it and no look finding away.

      1 Reply Last reply Reply Quote 0
      • K
        killmasta93
        last edited by

        can you post your NAT rules? what FTP server are you running? Did you open ports 21 and 5000 - 5100

        Tutorials:

        https://www.mediafire.com/folder/v329emaz1e9ih/Tutorials

        1 Reply Last reply Reply Quote 0
        • P
          Pringles
          last edited by

          Using Server 2012 R2 i have ftp working internal what do you mean open port 5000 - 5100 and port 21 is open

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by

            What mode are you clients connecting to your ftp server with active or passive?

            If clients out on net are using active, then your server would connect from its port 20 as source to their port say 42012 or whatever they tell the server to connect too.  If they are connecting to you with passive, then your server will tell them what port to connect too.  And yes you will have to forward those ports. 5000 to 5100 is a common range used.  What ports did you setup your ftp server to use for its passive ports?

            Here, anyone using ftp should really understand the difference between active and passive be they are running a server or just using it as client.
            http://slacksite.com/other/ftp.html

            On a side note, ftp is pretty deprecated these days.. Its a antiquated protocol from back in the day with its control and data channels, complete lack of any security in the auth method, etc.  Why not just using sftp.  You can install on windows for free if need be. Openssh installs on windows without any issue, they have their own port and there is the mls version.

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

            1 Reply Last reply Reply Quote 0
            • K
              kpa
              last edited by

              Please if you can, forget that active mode FTP ever existed and disable support for it completely. Active mode FTP requires firewall intervention at the client end to make the data connection pass from the server to the client. This is not acceptable anymore, use passive mode FTP only if you have no other options for sharing your files than an FTP server.

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by

                Agree in a corp environment, good luck getting active ftp to work.

                In home/smb that is using some off the shelf router, most of them have ftp helpers that will open the ports when it detects ftp.  Both active and passive, pfsense few versions back use to have such a helper.  There is currently a package for the active client mode, ie your behind pfsense using active connect to some ftp server on the net.

                Running active server behind pfsense pushes the nat/data channel issue with forwards to the client yes.

                My guess is your clients connecting passive and you didn't forward the passive range that your ftp server is using.

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                1 Reply Last reply Reply Quote 0
                • P
                  Pringles
                  last edited by

                  Right i have tried many different ports and still now look.

                  I know this is a big ask put can any one do team viewer and give me a hand. Add me on Skype ppringless

                  Thanks

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator
                    last edited by

                    why would you try many different ports?  What is your ftp server setup for for passive?  And your sure your clients are using passive?

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                    1 Reply Last reply Reply Quote 0
                    • P
                      Pringles
                      last edited by

                      The Port i have open are 5000-5100  20-21

                      1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator
                        last edited by

                        so you setup your ftp server to use ports 5000-5100, you set that?  I don't think that is the ports iis in windows ftp server uses those by default you would have to set those!!

                        And you ftp client is making a passive connection?

                        Why would you forward 20?  In NO scenario possible would you ever need to forward 20..  This is just no combination possible be active/passive client/server where port 20 would be forwarded.

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                        1 Reply Last reply Reply Quote 0
                        • P
                          Pringles
                          last edited by

                          Port open 21  5000 5100

                          now am getting this

                          Status: Connecting to 5.80.999.999:21…
                          Status: Connection established, waiting for welcome message...
                          Status: Insecure server, it does not support FTP over TLS.
                          Status: Logged in
                          Status: Retrieving directory listing...
                          Status: Server sent passive reply with unroutable address. Using server address instead.
                          Command: LIST
                          Response: 150 Opening BINARY mode data connection.
                          Error: The data connection could not be established: ECONNREFUSED - Connection refused by server

                          Thanks for the help am getting

                          1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator
                            last edited by

                            "Server sent passive reply with unroutable address. Using server address instead."

                            So your server sent back its RFC1918 address vs your public IP 5.80.999.999 in your example.  So is pfsense the actual edge doing nat?  Or is pfsense behind a nat already?  You should be able to see a log showing you exactly what is going on on your client.. And see the port command..

                            And again I will ask, you actually setup your FTP server to use the passive range 5000-5100, and you forwarded this on pfsense?  You should also tell your server to use your public IP and not its local rfc1918 address.

                            I don't have windows ftp setup on anything - but could install it to show you the appropriate windows. Take a look here how to set your external IP
                            https://www.iis.net/configreference/system.applicationhost/sites/sitedefaults/ftpserver/firewallsupport

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                            1 Reply Last reply Reply Quote 0
                            • P
                              Pringles
                              last edited by

                              Thank you all and a Big thanks to johnpoz  for the extra help

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.