FTP not working. NAT rules setup like I did with other ports except using port 21 and it's not working.

JLundberg

I understand. Thanks. I'm working on changing things over here at work. This is just one of my many hats.
The old webserver is on 2003 I'm working on changing things over to modern but had to work on getting our accounting pkg working on server 2016. The SonicWall is on its last leg and wanted to get it replaced before I ran into a big problem. I didn't plan on this being this difficult (at least for me) I know just enough to keep things going. I was able to find out the issue of our website not being able to connect from inside (was always trying to open back up pfsense when I would type in the website. I needed to turn on the default nat reflection. the default is off and I needed to set it to NAT + Proxy and that that started working. I have the FTP issue and then figuring out why when I vpn my client doesn't receive the DNS and I can't run without typing in the servers address. that last one can wait but our customers need to be able to connect to the ftp and download files.
In the SonicWall the main difference I see is it has the service setup as data port 20, Control port 21 Sort of like @Derelict
stated. (whereas the other nat policies I set have either HTTP, HTTPS or SSL etc. only one per my nat police.

how do I set multiple or do I set 2 policies one for port 21 and one for port 20 ? sorry for being such a novice on this

JLundberg

@Gertjan
Yes it's running IIS

JLundberg

@Derelict
Are you saying I will need to make changes to my current FTP server settings? So, pfsense can't be set up to function just like the older SonicWall? I may have misunderstood and sorry if I did.

DaddyGo

@JLundberg

@Gertjan "Btw : I won't says 'FTP' won't work. pfSense can do it - there is even a package that might help you. Can't say more, it's years that I left FTP usage. And that was a good thing."

if you still want to use this obsolete procedure, just "sftp"
this is the minimum

or separate the things from a "web" ........................ "FTP" server
or NAT behind and pushed up the port to a minimum of 30K

BTW: the scanners, disrupt the port 21

Derelict

@JLundberg said in FTP not working. NAT rules setup like I did with other ports except using port 21 and it's not working.:

@Derelict
Are you saying I will need to make changes to my current FTP server settings? So, pfsense can't be set up to function just like the older SonicWall? I may have misunderstood and sorry if I did.

I don't know how to explain it any clearer than I already did.

The sonicwall might have had some ALG that overcame misconfiguration of the server like something that translated the passive address sent by the server to the WAN address. pfSense has no such ALG.

JLundberg

I was hoping for a drop-in replacement (after correct setup) to replace the current SonicWall. pfsense seems to be more capable (not in my hands though... Crap I did want to spend my whole day here :(

Derelict

@JLundberg If there is ever a read-only Friday it is Friday, July 3. Second only to Friday December 23 probably.

DaddyGo

@JLundberg

SonicWall is not equal to pfSense
therefore we use

JLundberg

@Derelict
Understand. Yep I wanted to spend more time with my son. Single dad here. Thanks for your help. I'll continue to go over what you and the others have said.

DaddyGo

@JLundberg

the best you can do......
" I wanted to spend more time with my son."

Have a nice weekend

JLundberg

@Derelict
Yes I know you are explaining it clearly and I thank you for that. I wish I had more training to understand the clear things spoken of. Thanks again. I'll do some searching to try and understand more on if there was something like an ALG that made the SonicWall FTP easier to set up (but overall the sonicwall not having all the abilities like pfsense)

I thank you.

serbus

Hello!

My experience with sonicwall tz's is that they dynamically open ports to support ftp.

"SonicWall overcomes this problem by actively scanning FTP traffic using DPI and dynamically opening ports required for clients to connect to the server. This way, only the Control port, TCP port 21, requires to be explicitly opened in the SonicWall."
https://www.sonicwall.com/support/knowledge-base/configuration-for-a-passive-mode-ftp-server-behind-the-sonicwall/170505318942162/

John

JLundberg

@serbus
So I need to open explicitly open both or just 20 and leave my FTP NAT settings as they are?

johnpoz

@JLundberg said in FTP not working. NAT rules setup like I did with other ports except using port 21 and it's not working.:

So I need to open explicitly open both or just 20 and leave my FTP NAT

Port 20 never needs to be forwarded, it will only ever be a source port in an active session..

To correctly setup ftp behind a nat firewall, you need to understand how it works to be honest.

Here is a great write up..
https://slacksite.com/other/ftp.html

serbus

Hello!

FTP without the dynamic port forwarding was too much of a burden. I converted everything (Win servers, NAS, webops, clients, scripts, etc...) over to sftp. Security beyond basic src ip restrictions was never a concern for these particular ftp transfers, but the move to sftp was definitely on the todo list and the upgrades from sonicwalls -> netgates were the catalyst.

John