remote ftp ssl access failed
-
@johnpoz I have tried from many servers that they are on distinct networks (even geographically distant) but when I am behind pfsense I always have the same problem.
how can such a thing happen?
thanks. -
I have no idea - I am behind pfsense, zero issues as you have seen. But clearly the server sends you a FIN vs server hello.. How does that have anything to do with pfsense?
Are you running IPS on pfsense? pfsense has nothing to do with this communication, it passes traffic or it doesn't.. Its not going have the server send you a FIN..
-
@johnpoz I also tried on a new PC with Windows 10 (the other PCs are with Windows Server), only the operating system and nothing else and I have the same error message.
-
Maybe the site doesn't like your IP?
The server is sending you a fin vs server hello.. Contact them.. Pfsense doesn't send fin in place of server, the server your talking to does that.
-
@johnpoz I also tried from other networks (with different public IP address) but unfortunately the behavior does not change
I cannot understand how this situation is possible
anyway thanks for the support -
I don't understand it either.. I have no issues, using pfsense (pfsense wouldn't interfere with traffic anyway).. its either allowed or its not.. Your allowed to talk to the server via port 21... The same session is used to. Your seeing a fin back from the server, pfsense can not send those.
Can you send me a pcap from the wan side this time to validate that the client hello is being sent out the wan.. you can send to the same email address you did before.
Its possible with IPS that the client hello is being blocked, and then the server says well no client hello so just close.. Are you running ips - Snort? Or Suricata?
-
I got your latest email, not the actual capture but a picture.
In that looks like your sending fin to server, vs your hello.
Again I ask are you running IPS? The lan side sniff does not match up with the wan side. On the lan your showing sending a client hello and server sending back fin. But on wan side looks like your just sending fin and not the client hello.
-
@johnpoz I sent you the .cap file, I don't use any IPS.
Thanks. -
I got your email - no cap attached as stated in the email.
edit: Never mind I see it..
Dude I have no idea - your lan sniff shows client hello sent.. Then server sends you fin.. On your wan sniff you only send fin, no client hello..
Do a sniff at the same time.. But no its never going to work if you send fin vs client hello.
edit: ssh to pfsense twice.. then run two captures using tcpdump writing them to files. Using your interfaces vs mine where igb0 and igb1 are lan and wan on my setup.
We can then merge these sniffs and take a look at what is going on lan and wan at the same time
Here for example
You can grab the files you write via tcpdump by just sftp to your pfsense box..
You can see via the timestamps, etc.. as you see my client sends the hello and then .000019 seconds later it leaves the wan... packets 13 and 14 in the above picture.
please do such a capture and send me the files. This is turning out to be quite odd issue for sure..
-
@johnpoz hi, I have sent you the two requested files.
Thanks. -
Those are not taken at the same time...
Sniff at the SAME TIME!!!
I want to see what goes in, and then what comes out... You can not do that when you sniff on one side, and then sniff on the other side and run the test again.
The easy way is open 2 ssh sessions to pfsense.. So you can run sniff on lan and one on wan running at the same time.
It would be nice if way to do it in the gui - but I do no think there is..
Another way is you could do 1 in the gui, and the other one via tcpdump via ssh session.
-
@johnpoz sorry, now i did the capture at the same time and i sent you the files
-
Your running this all on vmware..
What are you running on pfsense - any packages, the ftp client proxy maybe? How exactly do you have this setup in vmware?
Pfsense would not send a fin on behalf of a connection out of the box..
-
@johnpoz yes, the client ftp proxy service is running on LAN interface.
this is the problem !! i disabled the ftp proxy client service and i managed to connect in ftp !!!
-
Where you listening on port 21? Ok yeah I enabled this is and instantly fails.. Why did you not mention you were running this from the get go? This would never work with ftps because it can not see the control connection. Pretty sure I mentioned that early in the thread..
It won't work because the ftp active helper can not open the port on pfsense for the connection from the server to client in active mode. And I don't have the active ports forwarded by hand.
I guess I should of been more clear on that - and asked up front about running the proxy. But since this proxy helper does not work with tls, why would you have it enabled?
Glad finally sorted - and will make it easier to find the next time someone has a sim issue..
-
@johnpoz I apologize for not having clearly written that I use ftp proxy client, this service is enabled as I need it for other vm that have different needs.
Thanks for your help and patience with me.
Regards. -
That is not needed unless your accessing a ftp via active...
Ftp is dead, should of been 10 years ago..
