ipsec rules not working

[zaber01]

hello , I have one concern . Actually I created the ipsec vpn between two pfsense and every thing is working fine. My one local network in 192.168.2.0/24 behind of firewall A and other is 192.168.1.0/24 behind firewall B. They are accessable to each other and working good.
Now the problem is that , I have to give the access of FTP only in my ipsec tunnel so that PC of firewall A can only take the FTP of PC of firewall B .
Whenever I am manipulating the rules in under ipsec tab like:

Protocol- TCP
Source-192.168.1.2/24 (PC of firewall A)
Destiation-192.168.2.2/24(PC of firewall B)
D.Port-21

then the issue get created and I am not able to take the ftp connection.I tried every possible variation but rule only work if I do all thing to any.
Note(This is rule is created at Firewall B only ; where I want to take FTP).
I only want to allow FTP service in my ipsec tunnel
Any one can help me please.

[stephenw10]

What sort of FTP is it?

You probably need to pass the data port range the server is using as well as port 21.

Steve

[zaber01]

@stephenw10 I am using vsftp on ubunut system. And according my knowledge data port used by ftp in 20 and for connection it uses 21.
So u you mean i have to allow only 20 and 21 port number for only FTP.

[zaber01]

@zaber01 I allowed both port and able to take ftp but not able to transfer the file to the target machine.

[stephenw10]

Nope in addition to port 21 you need to pass the passive port range, for eaxmple 10000-20000 but that that could be anything depending on how you've configured it.
Also vsftp seems to use ftps so needs port 990 also for the encryption.

See: https://www.howtoforge.com/tutorial/ubuntu-vsftpd/

You should be able to see that traffic blocked in the firewall log though when you try to connect and it fails.

Steve