Active mode ftp trouble



  • Hi,

    I have this setup:
    DMZ VLAN with ftp server behind SG-3100.
    NAT rule to point port 21 and a couple of high ports for incoming passive mode ftp to said ftp server on the dmz vlan.
    This is working as it should. Active mode and passive mode works from the internet to this server.

    However. There is a server on the LAN VLAN interface that sends ftp to various ftp servers on the internet.
    Some works and some dont. I narrowed it down to be the active mode ftp:s that don't work.

    So i found the FTP Client proxy package and installed it and enabled it on the LAN interface with the "destination exception" of the ftp server on the DMZ as the LAN server sends files there too. It still doesn't work on this site.

    I tried installing the package on my SG-1100 at home and active mode transfers started working as it should.

    I have tried removing the FTP NAT to the DMZ and reinstalled the FTP Client Proxy but still no go and incoming ftp breaks (of course).

    I found the "pfctl -sa | grep ftp" command but I'm not any wiser for it.

    nat-anchor "ftp-proxy/" all
    rdr-anchor "tftp-proxy/
    " all
    rdr on mvneta2 inet proto tcp from any to "WAN IP" port = ftp -> "DMZ FTP Server IP"
    rdr-anchor "ftp-proxy/" all
    no rdr on mvneta1 inet proto tcp from any to "DMZ FTP Server IP" port = ftp
    rdr pass on mvneta1 inet proto tcp from any to any port = ftp -> 127.0.0.1 port 8021
    anchor "ftp-proxy/
    " all
    pass in quick on mvneta2 reply-to (mvneta2 "Gateway IP") inet proto tcp from any to "DMZ FTP Server IP" port = ftp flags S/SA keep state label "USER_RULE: NAT FTP till VMGREENMAPP01"
    anchor "tftp-proxy/*" all

    When I try to connect with active mode I see in the state table that the proxy picks up and resends the traffic.

    I'm out of ideas as to why it's not working on the SG-3100 but "just worked" on the SG-1100.
    Both are at the 2.4.4-p3 version.

    Regards, Lars


  • Global Moderator

    @Lazer13 Is there any specific firewall rules on SG-3100?
    show firewalls rules difference



  • @viktor_g

    Floating has no rules

    WAN has this:

    • Standard block private and bogon networks.
    • Wan ip to DMZ ftp port 21
    • wan ip to DMZ ftp port 40000-40500
    • wan ip to DMZ ftp port 80 ( a web server also on the same VM as the ftp)
    • wan ip to LAN mailserver port 443
    • wan ip to LAN mailserver port 25
    • wan ip to LAN mailserver port 465
    • wan ip to LAN openvpn port 1194
    • from our office to wan ip to web console of sg-3100 port 444
    • drop all IPv4

    LAN has this:

    • standard antilockout rule port 444
    • Default allow any anywhere ipv4

    DMZ has this:

    • Allow any anywhere ipv4 (For now. will lock this down further later)

    GUEST has access to internet but not DMZ or LAN.

    OpenVPN any anywhere ipv4



  • @Lazer13 said in Active mode ftp trouble:

    Wan ip to DMZ ftp port 21

    This one has been removed for testing but still no go.
    I also removed the openvpn server.
    No difference


Log in to reply