FTPS behind pfSense
-
Hi
Know this has been up a lot of times, but I can't get it to work…I have a ProFTPd setup on LAN behind pfSens 2.3.2
It works from LAN, both FTP and TLS explicit with Filzilla.
From WAN I'm only able to connect with FTP but when I try TLS it halts.
FilZilla03:06:08 Status: Resolving address of xxx 03:06:08 Status: Connecting to xxx 03:06:08 Status: Connection established, waiting for welcome message... 03:06:08 Response: 220 ProFTPD 1.3.5b Server (nas4free FTP Server) [xx] 03:06:08 Command: AUTH TLS 03:06:08 Response: 502 AUTH TLS successful 03:06:08 Command: AUTH SSL 03:06:08 Error: Could not connect to server 03:06:08 Status: Waiting to retry... 03:06:13 Status: Resolving address of xxx 03:06:13 Status: Connecting to xxx... 03:06:13 Status: Connection established, waiting for welcome message... 03:06:14 Response: 220 ProFTPD 1.3.5b Server (nas4free FTP Server) [xxx] 03:06:14 Command: AUTH TLS 03:06:14 Response: 502 AUTH TLS successful 03:06:14 Command: AUTH SSL 03:06:14 Error: Could not connect to serverProFTPd
Jan 8 03:06:13 nas4free proftpd[8893]: 192.168.1.2 (xxx[xxx]) - mod_tls/2.6: unexpected OpenSSL error, disconnecting Jan 8 03:06:08 nas4free proftpd[8892]: 192.168.1.2 (xxx[xxx]) - mod_tls/2.6: unexpected OpenSSL error, disconnecting Jan 8 02:58:38 nas4free proftpd[8859]: 192.168.1.2 (xxx[xxx]) - FTP no transfer timeout, disconnected Jan 8 02:51:02 nas4free proftpd[8858]: 192.168.1.2 (xxx[xxx]) - mod_tls/2.6: unexpected OpenSSL error, disconnecting Jan 8 02:50:56 nas4free proftpd[8857]: 192.168.1.2 (xxx[xxx]) - mod_tls/2.6: unexpected OpenSSL error, disconnecting Jan 8 02:47:13 nas4free root: proftpd service restartedI have configured pfSense, with NAT for port 21 and the passive range according to this https://doc.pfsense.org/index.php/FTP_without_a_Proxy
And the same ports in ProFTPdAs I understand this and all other discussions the FTPS would work but not the FTP, because of the FTP Proxy is not there any more.
What am I doing wrong, I want it to be the other way around? Is the Proxy active some how?
-
Where did you get the idea that ftps is any different than ftp for pfsense and no proxy? ftps does not normally use 21, it normally uses 990.. Did you forward 990?
The point is that ftps wouldn't work even with the proxy/helper because pfsense can not see the control channel to even forward the data ports for you - so when using ftps you would always have to manually configure the correct ports when using passive.
