Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    resolved - FTP : connection closed by remote host

    Scheduled Pinned Locked Moved Routing and Multi WAN
    11 Posts 2 Posters 12.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • L
      LLFT
      last edited by LLFT

      Hello,

      I have to communicate with an FTP server that is behind 2 firewalls. The first is pfSense the second Cisco ASA.
      I manage to establish my connection with the server and do the operations transiting on port 21.

      As soon as I try to do an "ls" or a "dir" I get "connection closed by remote host"

      I tested my exchanges from end to end and I can not find the origin of the problem.
      VPN.png
      Here are the different tests I have done:

      FTP client 1 to FTP1 -> OK
      FTP client 2 to FTP2 -> OK
      FTP Client 1 to FTP2 -> NOK

      I have removed all the port restrictions, passed the FTP session in passive and I do not understand why it does not work.

      Would I have omitted an essential point of FTP exchanges?

      Thanks

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by johnpoz

        And are you using active or passive?

        In active the server will try and connect back to the client.. With passive the server will send an IP and port that the client connects to..

        So you would need to make sure the ftp server sends the correct IP to the client that it can get to, and you would need to make sure the ports that server would use for the passive range are forwarded as well.

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        1 Reply Last reply Reply Quote 0
        • L
          LLFT
          last edited by

          I use the passive mode.
          I noticed in my screenshots the frame "Request: PORT 10,8,9,11,236,54" and thus allowed my FTP 2 to communicate with the VPN tunnel.

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by johnpoz

            Your not using passive your seeing a port command...

            That is the command issued by the client to connect to him on port 236x256 + 54 or port 59762

            Here is good write up on the differences
            https://slacksite.com/other/ftp.html

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            1 Reply Last reply Reply Quote 0
            • L
              LLFT
              last edited by

              Indeed bad line "Response: 227 Entering Passive Mode (10,240,69,89,230,162)"

              FTP client 1 requests PASSIVE mode

              Below is a frame capture:
              Left: the entry of the ASA
              Right: the exit of the ASA
              Annotation 2019-10-03 162112.png

              We see that the request port does not cross the firewall

              1 Reply Last reply Reply Quote 0
              • L
                LLFT
                last edited by

                I still have not found the origin of my problem.

                Do you have an idea ?

                1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator
                  last edited by johnpoz

                  Your problem is when your client tries to go to 10.240.69.89 port 230x256 + 162 = 59042 is not open...

                  Your sniff is showing port command..

                  Your not going to get ftp to work be it active or passive unless you actually understand how it works.. And then open the appropriate ports to allow the method your going to use to work...

                  You would be much better off just using sftp, which would be 1 single port and you wouldn't have to worry about the data channel making another connection.

                  What client are you using - how is your server setup.. for example windows ftp.exe doesn't even support passive.. And maybe your server is not setup to allow it, etc.

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  1 Reply Last reply Reply Quote 0
                  • L
                    LLFT
                    last edited by LLFT

                    Unfortunately, I do not master the outs.
                    I am in an industrial environment, the server and the client are black boxes.

                    I have to my knowledge only the aforementioned elements namely that the customer is in passive mode

                    I am trying to simulate FTP interaction with Windows FTP and FileZilla.

                    I'm going to look at why ports "59042 & co" would be blocked.

                    Thank you for your analysis

                    1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator
                      last edited by

                      if your doing active ftp, which is the only thing windows ftp.exe client supports.. Then the server will talk back to you on the port and IP given by the client.

                      Does the ftp server even know how to get back to you..

                      In your drawing the ASA would need a route to get back to pfsense for the tunnel network. Is pfsense its default route for the asa? I also noticed you list pfsense address as .255 in you drawing.. That would be wrong a /24 - since that is the broadcast address of a /24

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      1 Reply Last reply Reply Quote 0
                      • L
                        LLFT
                        last edited by

                        Je confirme l'ASA est bien la route par défaut du serveur FTP, les routes sont établies de l'ASA au VPN en passant par pfSense.

                        Le traceroute du SRV au CLT fait bien les 4 sauts prévus.

                        Il s'agit en effet d'une erreur de dessin.

                        1 Reply Last reply Reply Quote 0
                        • L
                          LLFT
                          last edited by

                          It seems that it works, I heard your review on the windows FTP client that does not handle the passive mode.

                          So I retested with FileZilla forcing the passive mode and it works.

                          I certainly had a rule that jammed before that.

                          Thank you for your help.

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.