FTP Port Forwarding Issue

Pringles · Jun 5, 2016, 8:18 PM

Hello al
I am Trying to port ftp in Nat not getting ant look at al can any one help me i have bean reading a lot about it and no look finding away.

killmasta93 · Jun 5, 2016, 8:19 PM

can you post your NAT rules? what FTP server are you running? Did you open ports 21 and 5000 - 5100

Pringles · Jun 5, 2016, 8:49 PM

Using Server 2012 R2 i have ftp working internal what do you mean open port 5000 - 5100 and port 21 is open

johnpoz · Jun 6, 2016, 11:08 AM

What mode are you clients connecting to your ftp server with active or passive?

If clients out on net are using active, then your server would connect from its port 20 as source to their port say 42012 or whatever they tell the server to connect too. If they are connecting to you with passive, then your server will tell them what port to connect too. And yes you will have to forward those ports. 5000 to 5100 is a common range used. What ports did you setup your ftp server to use for its passive ports?

Here, anyone using ftp should really understand the difference between active and passive be they are running a server or just using it as client.
http://slacksite.com/other/ftp.html

On a side note, ftp is pretty deprecated these days.. Its a antiquated protocol from back in the day with its control and data channels, complete lack of any security in the auth method, etc. Why not just using sftp. You can install on windows for free if need be. Openssh installs on windows without any issue, they have their own port and there is the mls version.

kpa · Jun 6, 2016, 11:12 AM

Please if you can, forget that active mode FTP ever existed and disable support for it completely. Active mode FTP requires firewall intervention at the client end to make the data connection pass from the server to the client. This is not acceptable anymore, use passive mode FTP only if you have no other options for sharing your files than an FTP server.

johnpoz · Jun 6, 2016, 11:51 AM

Agree in a corp environment, good luck getting active ftp to work.

In home/smb that is using some off the shelf router, most of them have ftp helpers that will open the ports when it detects ftp. Both active and passive, pfsense few versions back use to have such a helper. There is currently a package for the active client mode, ie your behind pfsense using active connect to some ftp server on the net.

Running active server behind pfsense pushes the nat/data channel issue with forwards to the client yes.

My guess is your clients connecting passive and you didn't forward the passive range that your ftp server is using.

Pringles · Jun 6, 2016, 12:25 PM

Right i have tried many different ports and still now look.

I know this is a big ask put can any one do team viewer and give me a hand. Add me on Skype ppringless

Thanks

johnpoz · Jun 6, 2016, 1:04 PM

why would you try many different ports? What is your ftp server setup for for passive? And your sure your clients are using passive?

Pringles · Jun 6, 2016, 1:08 PM

The Port i have open are 5000-5100 20-21

johnpoz · Jun 6, 2016, 1:13 PM

so you setup your ftp server to use ports 5000-5100, you set that? I don't think that is the ports iis in windows ftp server uses those by default you would have to set those!!

And you ftp client is making a passive connection?

Why would you forward 20? In NO scenario possible would you ever need to forward 20.. This is just no combination possible be active/passive client/server where port 20 would be forwarded.

Pringles · Jun 6, 2016, 3:16 PM

Port open 21 5000 5100

now am getting this

Status: Connecting to 5.80.999.999:21…
Status: Connection established, waiting for welcome message...
Status: Insecure server, it does not support FTP over TLS.
Status: Logged in
Status: Retrieving directory listing...
Status: Server sent passive reply with unroutable address. Using server address instead.
Command: LIST
Response: 150 Opening BINARY mode data connection.
Error: The data connection could not be established: ECONNREFUSED - Connection refused by server

Thanks for the help am getting

johnpoz · Jun 7, 2016, 4:35 PM

"Server sent passive reply with unroutable address. Using server address instead."

So your server sent back its RFC1918 address vs your public IP 5.80.999.999 in your example. So is pfsense the actual edge doing nat? Or is pfsense behind a nat already? You should be able to see a log showing you exactly what is going on on your client.. And see the port command..

And again I will ask, you actually setup your FTP server to use the passive range 5000-5100, and you forwarded this on pfsense? You should also tell your server to use your public IP and not its local rfc1918 address.

I don't have windows ftp setup on anything - but could install it to show you the appropriate windows. Take a look here how to set your external IP
https://www.iis.net/configreference/system.applicationhost/sites/sitedefaults/ftpserver/firewallsupport

Pringles · Jun 8, 2016, 3:29 PM

Thank you all and a Big thanks to johnpoz for the extra help