remote ftp ssl access failed
-
@johnpoz I sent you the .cap file, I don't use any IPS.
Thanks. -
I got your email - no cap attached as stated in the email.
edit: Never mind I see it..
Dude I have no idea - your lan sniff shows client hello sent.. Then server sends you fin.. On your wan sniff you only send fin, no client hello..
Do a sniff at the same time.. But no its never going to work if you send fin vs client hello.
edit: ssh to pfsense twice.. then run two captures using tcpdump writing them to files. Using your interfaces vs mine where igb0 and igb1 are lan and wan on my setup.
We can then merge these sniffs and take a look at what is going on lan and wan at the same time
Here for example
You can grab the files you write via tcpdump by just sftp to your pfsense box..
You can see via the timestamps, etc.. as you see my client sends the hello and then .000019 seconds later it leaves the wan... packets 13 and 14 in the above picture.
please do such a capture and send me the files. This is turning out to be quite odd issue for sure..
-
@johnpoz hi, I have sent you the two requested files.
Thanks. -
Those are not taken at the same time...
Sniff at the SAME TIME!!!
I want to see what goes in, and then what comes out... You can not do that when you sniff on one side, and then sniff on the other side and run the test again.
The easy way is open 2 ssh sessions to pfsense.. So you can run sniff on lan and one on wan running at the same time.
It would be nice if way to do it in the gui - but I do no think there is..
Another way is you could do 1 in the gui, and the other one via tcpdump via ssh session.
-
@johnpoz sorry, now i did the capture at the same time and i sent you the files
-
Your running this all on vmware..
What are you running on pfsense - any packages, the ftp client proxy maybe? How exactly do you have this setup in vmware?
Pfsense would not send a fin on behalf of a connection out of the box..
-
@johnpoz yes, the client ftp proxy service is running on LAN interface.
this is the problem !! i disabled the ftp proxy client service and i managed to connect in ftp !!!
-
Where you listening on port 21? Ok yeah I enabled this is and instantly fails.. Why did you not mention you were running this from the get go? This would never work with ftps because it can not see the control connection. Pretty sure I mentioned that early in the thread..
It won't work because the ftp active helper can not open the port on pfsense for the connection from the server to client in active mode. And I don't have the active ports forwarded by hand.
I guess I should of been more clear on that - and asked up front about running the proxy. But since this proxy helper does not work with tls, why would you have it enabled?
Glad finally sorted - and will make it easier to find the next time someone has a sim issue..
-
@johnpoz I apologize for not having clearly written that I use ftp proxy client, this service is enabled as I need it for other vm that have different needs.
Thanks for your help and patience with me.
Regards. -
That is not needed unless your accessing a ftp via active...
Ftp is dead, should of been 10 years ago..
