resolved - FTP : connection closed by remote host

[LLFT]

Hello,

I have to communicate with an FTP server that is behind 2 firewalls. The first is pfSense the second Cisco ASA.
I manage to establish my connection with the server and do the operations transiting on port 21.

As soon as I try to do an "ls" or a "dir" I get "connection closed by remote host"

I tested my exchanges from end to end and I can not find the origin of the problem.

Here are the different tests I have done:

FTP client 1 to FTP1 -> OK
FTP client 2 to FTP2 -> OK
FTP Client 1 to FTP2 -> NOK

I have removed all the port restrictions, passed the FTP session in passive and I do not understand why it does not work.

Would I have omitted an essential point of FTP exchanges?

Thanks

[johnpoz]

And are you using active or passive?

In active the server will try and connect back to the client.. With passive the server will send an IP and port that the client connects to..

So you would need to make sure the ftp server sends the correct IP to the client that it can get to, and you would need to make sure the ports that server would use for the passive range are forwarded as well.

[LLFT]

I use the passive mode.
I noticed in my screenshots the frame "Request: PORT 10,8,9,11,236,54" and thus allowed my FTP 2 to communicate with the VPN tunnel.

[johnpoz]

Your not using passive your seeing a port command...

That is the command issued by the client to connect to him on port 236x256 + 54 or port 59762

Here is good write up on the differences
https://slacksite.com/other/ftp.html

[LLFT]

Indeed bad line "Response: 227 Entering Passive Mode (10,240,69,89,230,162)"

FTP client 1 requests PASSIVE mode

Below is a frame capture:
Left: the entry of the ASA
Right: the exit of the ASA

We see that the request port does not cross the firewall

[LLFT]

I still have not found the origin of my problem.

Do you have an idea ?

[johnpoz]

Your problem is when your client tries to go to 10.240.69.89 port 230x256 + 162 = 59042 is not open...

Your sniff is showing port command..

Your not going to get ftp to work be it active or passive unless you actually understand how it works.. And then open the appropriate ports to allow the method your going to use to work...

You would be much better off just using sftp, which would be 1 single port and you wouldn't have to worry about the data channel making another connection.

What client are you using - how is your server setup.. for example windows ftp.exe doesn't even support passive.. And maybe your server is not setup to allow it, etc.

[LLFT]

Unfortunately, I do not master the outs.
I am in an industrial environment, the server and the client are black boxes.

I have to my knowledge only the aforementioned elements namely that the customer is in passive mode

I am trying to simulate FTP interaction with Windows FTP and FileZilla.

I'm going to look at why ports "59042 & co" would be blocked.

Thank you for your analysis

[johnpoz]

if your doing active ftp, which is the only thing windows ftp.exe client supports.. Then the server will talk back to you on the port and IP given by the client.

Does the ftp server even know how to get back to you..

In your drawing the ASA would need a route to get back to pfsense for the tunnel network. Is pfsense its default route for the asa? I also noticed you list pfsense address as .255 in you drawing.. That would be wrong a /24 - since that is the broadcast address of a /24

[LLFT]

Je confirme l'ASA est bien la route par défaut du serveur FTP, les routes sont établies de l'ASA au VPN en passant par pfSense.

Le traceroute du SRV au CLT fait bien les 4 sauts prévus.

Il s'agit en effet d'une erreur de dessin.

[LLFT]

It seems that it works, I heard your review on the windows FTP client that does not handle the passive mode.

So I retested with FileZilla forcing the passive mode and it works.

I certainly had a rule that jammed before that.

Thank you for your help.