FTP Client problem

[sasa1]

Hi,
I have a problem accessing ftp servers, only from clients that are behind pfsense, after logging in and running "ls" command I can not see the list of files.
This problem only occurs with the Microsoft ftp client (I tried with Windows 2012, 2016) while with filezilla I have no problems.
Thanks.

[johnpoz]

ms ftp client only supports active mode. If you want to use active mode ftp with client behind pfsense to ftp server outside pfsense you need to install the ftp package and configure it. Its called FTP_Client_Proxy in the packages.

[sasa1]

Hi, the ftp server that I try access support passive mode (and with filezilla I connect in passive mode), I still need to install the package FTP_Client_Proxy ?
To these ftp servers, from clients that are not behind pfsense, I can log in with ms ftp client with success.
Thanks.

[johnpoz]

Again the ftp client (ftp.exe) in windows only supports ACTIVE... If you want to use active on clients behind pfsense then you need to install that package..

If your clients use passive then no you do not need the package... Understanding how ftp works is step 1 ;)
http://slacksite.com/other/ftp.html
Active FTP vs. Passive FTP, a Definitive Explanation

That your still using ftp at all would be the question I would be asking yourself... It should of died off 10 years ago... Why can you not use sftp?

[sasa1]

Hi,
unfortunately, the ftp servers to which I have to connect are not managed by me, I use the client part.
I attach image related to the error I have on the ftp client.
The same connection, from the same ftp client to the same ftp server, from a PC that is not behind pfsense works well.
Thanks.

[johnpoz]

Dude how dense can you be?? the ftp.exe in pfsense does NOT support passive... If you want to use active ftp client behind pfsense you need to install the ftp package!!

They might have a passive cmd - IT DOESNT WORK!!! windows ftp.exe ONLY supports active!!!

[sasa1]

Hi,
so an ftp client that is behind pfsense and needs to access an ftp server that only supports passive mode, will it never work?
did I get it right ?
Thanks.

[stephenw10]

No.
Passive FTP will work fine with the client behind pfSense without the proxy package.
Active FTP requires the client proxy package.

Since the Windows ftp client apparently only supports active mode you need the client proxy package.

https://www.netgate.com/docs/pfsense/nat/ftp-without-a-proxy.html#client-behind-pfsense

But are you sure those servers don't support encrypted mode? If they do you just switch to that.

Steve

[johnpoz]

So which is it you do not read english, or your trolling... Have been over this multiple times now!!

Please what part is unclear here

Again the ftp client (ftp.exe) in windows only supports ACTIVE... If you want to use active on clients behind pfsense then you need to install that package..

If your clients use passive then no you do not need the package...

And before that how can this be clearer

ms ftp client only supports active mode. If you want to use active mode ftp with client behind pfsense to ftp server outside pfsense you need to install the ftp package and configure it. Its called FTP_Client_Proxy in the packages.

Your ftp.exe command tells the server hey lets do passive - and the server answers back ok, lets do passive - connect here on this port... The problem is the ftp.exe from windows will not do passive... You have to use the ftp package in pfsense to allow for active connections from clients behind pfsense because the firewall needs to open the port back to the client..

[sasa1]

Hi,
it does not work either in active or passive mode.
I installed the ftp proxy package and I indicated the LAN as an interface to be used (I have not modified any other parameter) but also in this way I always have the same problem.

I'm sorry if I did not understand what you told me but I can not understand where I'm wrong.
Thanks.

[stephenw10]

If you set 'Log Connections' in the proxy settings do you see firewall log entries for it?

Do you see blocked traffic from the FTP server?

You might try using a different FTP client as a test here such as Filezilla. That will show you exactly what it's doing.

Steve

[johnpoz]

is the checkbox set to move it up the higher on the rules?

Here just tested this

C:\WINDOWS\system32>ftp speedtest.tele2.net
Connected to speedtest.tele2.net.
220 (vsFTPd 2.3.5)
200 Always in UTF8 mode.
User (speedtest.tele2.net:(none)): anonymous
331 Please specify the password.
Password:
230 Login successful.
ftp> ls
200 PORT command successful. Consider using PASV.
150 Here comes the directory listing.
1000GB.zip
100GB.zip
100KB.zip
100MB.zip
10GB.zip
10MB.zip
1GB.zip
1KB.zip
1MB.zip
200MB.zip
20MB.zip
2MB.zip
3MB.zip
500MB.zip
50MB.zip
512KB.zip
5MB.zip
upload
226 Directory send OK.
ftp: 183 bytes received in 0.02Seconds 11.44Kbytes/sec.
ftp>

active works just fine with windows ftp client behind pfsense..

You can see where its allowed through the firewall with these rules

 	Jan 30 12:28:54 	► LAN 	(@0) 	90.130.70.73:20		192.168.9.100:55659		TCP:S
	Jan 30 12:28:54 	WAN 	(@0) 	90.130.70.73:20		192.168.9.100:55659		TCP:S 

Here doing it again with sniff..

Notice the port command sent is my machine rfc1918 IP, the ftp client changes that to my public IP, and if you do the math on the command (217*256)+148 = 55700 which is the port the data channel is sent to..

[sasa1]

@stephenw10
Trace: CControlSocket::SendNextCommand()
Trace: CFtpLogonOpData::Send() in state 0
Stato: Risoluzione dell'indirizzo IP x.y.eu in corso
Stato: Connessione a x.x.x.x:21...
Stato: Connessione stabilita, in attesa del messaggio di benvenuto...
Trace: CFtpControlSocket::OnReceive()
Risposta: 220 Microsoft FTP Service
Trace: CFtpLogonOpData::ParseResponse() in state 1
Trace: CControlSocket::SendNextCommand()
Trace: CFtpLogonOpData::Send() in state 5
Comando: USER pippo
Trace: CFtpControlSocket::OnReceive()
Risposta: 331 Password required
Trace: CFtpLogonOpData::ParseResponse() in state 5
Trace: CControlSocket::SendNextCommand()
Trace: CFtpLogonOpData::Send() in state 5
Comando: PASS **********
Trace: CFtpControlSocket::OnReceive()
Risposta: 230 User logged in.
Trace: CFtpLogonOpData::ParseResponse() in state 5
Trace: CControlSocket::SendNextCommand()
Trace: CFtpLogonOpData::Send() in state 9
Comando: OPTS UTF8 ON
Trace: CFtpControlSocket::OnReceive()
Risposta: 200 OPTS UTF8 command successful - UTF8 encoding now ON.
Trace: CFtpLogonOpData::ParseResponse() in state 9
Stato: Accesso effettuato
Trace: Measured latency of 5 ms
Trace: CFtpControlSocket::ResetOperation(0)
Trace: CControlSocket::ResetOperation(0)
Trace: CFtpLogonOpData::Reset(0) in state 14

[sasa1]

@johnpoz I do not work, when I run "ls" I have the error message that I attach

[johnpoz]

I don't see any port or pasv command sent in that log... Just sniff on the wan and lan of pfsense while you doing this so you can validate what is happening... ftp control is in the clear so as you see above you can see exactly what is sent by the client in the control channel. If when you sniff on the wan side you will see the ftp package change your port command to your actual public IP

Is pfsense behind a NAT? Not going to work if behind a NAT..

Is the wan of pfsense on a public IP? Sniff while you do that test of ftp to speedtest.tele2.net

So we can see exactly what is happening.

[sasa1]

yes, the computer is behind a NAT, it has a private IP address.

[johnpoz]

NO pfsense is its wan a rfc1918 or the is it public?

[sasa1]

@johnpoz on pfsense I have wan interface e lan interface, on wan interface I have an public IP address.

[johnpoz]

Like I said do a simple sniff.. And you can see exactly what is going on..

Here sniff (diag, packet capture on my wan) you can see my login on port 21... See where the PORT command gets changed to my public IP..

Then here comes the data connection to the port in the the port command

(200*256)+175 = port 51375

[sasa1]

This post is deleted!