Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    FTP Client problem

    Scheduled Pinned Locked Moved General pfSense Questions
    ftp client
    33 Posts 4 Posters 4.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      sasa1 @johnpoz
      last edited by

      @johnpoz on pfsense I have wan interface e lan interface, on wan interface I have an public IP address.

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by

        Like I said do a simple sniff.. And you can see exactly what is going on..

        Here sniff (diag, packet capture on my wan) you can see my login on port 21... See where the PORT command gets changed to my public IP..

        0_1548874506740_sniffonwan.png

        Then here comes the data connection to the port in the the port command

        0_1548874537590_datasniffonwan.png

        (200*256)+175 = port 51375

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        S 2 Replies Last reply Reply Quote 0
        • S
          sasa1 @johnpoz
          last edited by

          This post is deleted!
          1 Reply Last reply Reply Quote 0
          • S
            sasa1 @johnpoz
            last edited by

            @johnpoz sorry I do not know how to capture the really useful information, in the figure I sent I deleted the private IP address that is shown in the capture0_1548881523155_Cattura.JPG

            1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator
              last edited by johnpoz

              Dude are you hiding a 10.x.x.x address? Why??? They are private and do not route on the internet... That info is useless to anyone knowing what it is.. Its like telling you I live in the US.. or the planet Earth.. Notice how I didn't hide my 192.168.9.100 address ;) You can capture the info right on pfsense.. diagnostic menu packet capture.

              Do the capture on your WAN interface so we can validate its getting changed to your public wan IP.. Then just download the capture and open with wireshark.

              In wireshark just right click on say the syn of the control channel and say follow stream.

              BTW, I am a mod so I can see your deleted post ;) There is ZERO reason to hide 10.0.0.18.. You need to validate that gets changed on your WAN.. This is why you need to do the sniff on the WAN of pfsense to validate your ftp package is working.

              here
              0_1548883707284_packetcapture.png

              Then download and open with wireshark
              0_1548883729585_openwithwire.png

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              S 1 Reply Last reply Reply Quote 0
              • S
                sasa1 @johnpoz
                last edited by

                @johnpoz here is the log, I hope it contains useful information.
                Thanks.0_1548927500486_cattura1.PNG

                1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator
                  last edited by johnpoz

                  So he sent data connect to port 51069, which is correct per the PORT command.. (199*256)+125 but no answer..

                  Did the package not create the firewall rule? Did it not get placed at the top like I asked before

                  0_1548928001120_ftpproxy.png

                  Did the pfsense forward it, but your client didn't answer? Sniff on the LAN side now when you do the test.. We can see from the sniff that the PORT command was changed to your public IP with that 167.x.x.x

                  So yeah its very useful information.

                  What are your firewall rules on your WAN? Are you running packages like Snort or Pfblocker?

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  S 1 Reply Last reply Reply Quote 0
                  • S
                    sasa1 @johnpoz
                    last edited by

                    @johnpoz I have checked the "Early Firewall Rule" but I do not see any new rules in either LAN or WAN.
                    In Rules -> WAN I have only the default rules and I do not use Snot or similar packages.
                    Thanks.1_1548929897417_Cattura2.PNG 0_1548929897416_rules WAN.PNG

                    1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator
                      last edited by

                      Well from your sniff you can see that the data connection was sent on by pfsense - so its doing EXACTLY what it is suppose to do... Yet your client is NOT answering...

                      (193x256)+69 = port 49477

                      You see all the SYN to your clients IP 10.0.0.18... Why does it NOT answer? Host firewall?

                      0_1548930544209_clientnotanswer.png

                      So why would your client not answer. I can see that the port is not set to 20 as source.. But it was on your sniff on WAN, Its possible your client WANTS that... Click this in in the package

                      0_1548930782828_portto20.png

                      Now test it again.. Bet you works now.

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      S 1 Reply Last reply Reply Quote 1
                      • S
                        sasa1 @johnpoz
                        last edited by

                        @johnpoz with WIndows Firewall disable the ftp problem did not occur !
                        there was no need to check "rewrite source ..".
                        On the windows firewall do I have to enable traffic on high ports?
                        thank you

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by johnpoz

                          You would need to enable the application ftp.exe in the firewall most likely.. I don't use windows firewall - I have it disabled on all my windows boxes.. They all reside on a SECURE trusted local network that is isolated from all the iot gear and and anything that gets touched by the outside.. No reason to run it.. Leave it off locally - but set to say if my wife takes laptop out to some hotspot it would be on, etc.

                          But yeah your not going to know what port the client tells the server to connect to... This is the reason for the ftp helper package. The firewall needs to view the control channel info.. And it needs to do 2 things, it needs to change the clients port command from the rfc1918 address to what the public IP is.. And it needs to open a firewall rule/port forward for the data channel traffic the server will send to that IP and port so it gets back to the client.

                          Your host firewall would need to make sure it allows for what looks like unsolicited traffic from the server when it starts the data connection in active mode.

                          Your much better off using a client that does passive.. Since in passive mode both the control and data channel are initiated by the client.. So no need for the ftp helper package, and no need for inbound firewall rules, etc.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          1 Reply Last reply Reply Quote 0
                          • stephenw10S
                            stephenw10 Netgate Administrator
                            last edited by

                            Nice.

                            Interesting that it behaved differently with a different router. I imagine the windows firewall saw it as a new network.

                            Steve

                            1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator
                              last edited by

                              yup its quite possible that it was turned off on the other network, and when put behind pfsense it switched to public, etc.

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              1 Reply Last reply Reply Quote 0
                              • werterW
                                werter
                                last edited by werter

                                @sasa1
                                Hi.

                                Just create Alias with your ftp servers IPs\names and then make fw rule on LAN when this Alias would be in Dst with needed ftp ports. Set this rule first by order.

                                1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator
                                  last edited by

                                  huh? Dude you might want to actually read the thread before responding ;)

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  1 Reply Last reply Reply Quote 0
                                  • stephenw10S
                                    stephenw10 Netgate Administrator
                                    last edited by

                                    Um... yeah that would not have helped at all in this case. Traffic to any ftp server was already allowed and passing.

                                    Steve

                                    1 Reply Last reply Reply Quote 0
                                    • First post
                                      Last post
                                    Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.