FTPS behind pfSense



  • Hi
    Know this has been up a lot of times, but I can't get it to work…

    I have a ProFTPd setup on LAN behind pfSens 2.3.2
    It works from LAN, both FTP and TLS explicit with Filzilla.
    From WAN I'm only able to connect with FTP but when I try TLS it halts.
    FilZilla

    03:06:08   Status:   Resolving address of xxx
    03:06:08   Status:   Connecting to xxx
    03:06:08   Status:   Connection established, waiting for welcome message...
    03:06:08   Response:   220 ProFTPD 1.3.5b Server (nas4free FTP Server) [xx]
    03:06:08   Command:   AUTH TLS
    03:06:08   Response:   502 AUTH TLS successful
    03:06:08   Command:   AUTH SSL
    03:06:08   Error:   Could not connect to server
    03:06:08   Status:   Waiting to retry...
    03:06:13   Status:   Resolving address of xxx
    03:06:13   Status:   Connecting to xxx...
    03:06:13   Status:   Connection established, waiting for welcome message...
    03:06:14   Response:   220 ProFTPD 1.3.5b Server (nas4free FTP Server) [xxx]
    03:06:14   Command:   AUTH TLS
    03:06:14   Response:   502 AUTH TLS successful
    03:06:14   Command:   AUTH SSL
    03:06:14   Error:   Could not connect to server
    

    ProFTPd

    Jan 8 03:06:13   nas4free   proftpd[8893]: 192.168.1.2 (xxx[xxx]) - mod_tls/2.6: unexpected OpenSSL error, disconnecting
    Jan 8 03:06:08   nas4free   proftpd[8892]: 192.168.1.2 (xxx[xxx]) - mod_tls/2.6: unexpected OpenSSL error, disconnecting
    Jan 8 02:58:38   nas4free   proftpd[8859]: 192.168.1.2 (xxx[xxx]) - FTP no transfer timeout, disconnected
    Jan 8 02:51:02   nas4free   proftpd[8858]: 192.168.1.2 (xxx[xxx]) - mod_tls/2.6: unexpected OpenSSL error, disconnecting
    Jan 8 02:50:56   nas4free   proftpd[8857]: 192.168.1.2 (xxx[xxx]) - mod_tls/2.6: unexpected OpenSSL error, disconnecting
    Jan 8 02:47:13   nas4free   root: proftpd service restarted
    

    I have configured pfSense, with NAT for port 21 and the passive range according to this https://doc.pfsense.org/index.php/FTP_without_a_Proxy
    And the same ports in ProFTPd

    As I understand this and all other discussions the FTPS would work but not the FTP, because of the FTP Proxy is not there any more.
    What am I doing wrong, I want it to be the other way around? Is the Proxy active some how?


  • LAYER 8 Global Moderator

    Where did you get the idea that ftps is any different than ftp for pfsense and no proxy?  ftps does not normally use 21, it normally uses 990..  Did you forward 990?

    The point is that ftps wouldn't work even with the proxy/helper because pfsense can not see the control channel to even forward the data ports for you - so when using ftps you would always have to manually configure the correct ports when using passive.


Log in to reply