FTP for WordPress - How ?

[dhenzler]

@dhenzler

More confused than ever...

Client Behind pfSense

FTPS, or encrypted FTP, is not affected. The proxy could not have affected its traffic before.

A client on a LAN or other internal interface behind a pfSense firewall will likely not notice any difference. Most clients, aside from the Microsoft command line FTP program, default to passive (PASV) FTP, where clients make outbound connections to servers.

Passive mode on the client will require access to random/high ports outbound, which could run afoul of a strict outbound ruleset. Environments with a security policy that requires strict outbound firewall rules likely would not be using FTP anyhow, as it transmits credentials without encryption.

Active mode FTP through NAT will not function as that relies on a proxy or similar mechanism. Use Passive mode instead. Another option is the recently added FTP Client Proxy package which leverages in FreeBSD to allow clients on local interfaces to reach remote FTP servers with active FTP.

Active mode FTP for a client that does not involve NAT (Client has a public IP address) should work so long as WAN rules pass the appropriate traffic back to the client. The client may have a configurable active port range to make that simpler.
Server Behind pfSense

FTPS, or encrypted FTP, is not affected. The proxy could not have affected its traffic before.

A server behind pfSense would work fine with active mode, there would be no difference here. In active mode the server would make outbound connections back to the client, so as long as the firewall rules on the interface containing the server allow outbound connections, it will work.

A server behind pfSense running in Passive mode will function but requires a few items to be configured:

Port forwards or 1:1 NAT to forward not only port 21, but also the passive port range in to the server

The passive port range must be configured on the server, corresponding to the range of ports forwarded in the previous step.

The server may also need to be configured to account for NAT. Some clients will ignore private addresses in passive responses so this may not be necessary.

Sample Configuration for vsftpd

In vsftpd.conf:

Do not allow the client to use PORT

port_enable=NO

Use the hostname in the PASV response (DNS must be setup and match!)

pasv_addr_resolve=YES

Enable Passive Mode

pasv_enable=YES

Set the passive port range (1000 ports)

pasv_min_port=20000
pasv_max_port=20999

[dhenzler]

@johnpoz

Client Behind pfSense

FTPS, or encrypted FTP, is not affected. The proxy could not have affected its traffic before.

A client on a LAN or other internal interface behind a pfSense firewall will likely not notice any difference. Most clients, aside from the Microsoft command line FTP program, default to passive (PASV) FTP, where clients make outbound connections to servers.

Passive mode on the client will require access to random/high ports outbound, which could run afoul of a strict outbound ruleset. Environments with a security policy that requires strict outbound firewall rules likely would not be using FTP anyhow, as it transmits credentials without encryption.

Active mode FTP through NAT will not function as that relies on a proxy or similar mechanism. Use Passive mode instead. Another option is the recently added FTP Client Proxy package which leverages in FreeBSD to allow clients on local interfaces to reach remote FTP servers with active FTP.

Active mode FTP for a client that does not involve NAT (Client has a public IP address) should work so long as WAN rules pass the appropriate traffic back to the client. The client may have a configurable active port range to make that simpler.
Server Behind pfSense

FTPS, or encrypted FTP, is not affected. The proxy could not have affected its traffic before.

A server behind pfSense would work fine with active mode, there would be no difference here. In active mode the server would make outbound connections back to the client, so as long as the firewall rules on the interface containing the server allow outbound connections, it will work.

A server behind pfSense running in Passive mode will function but requires a few items to be configured:

Port forwards or 1:1 NAT to forward not only port 21, but also the passive port range in to the server

The passive port range must be configured on the server, corresponding to the range of ports forwarded in the previous step.

The server may also need to be configured to account for NAT. Some clients will ignore private addresses in passive responses so this may not be necessary.

Sample Configuration for vsftpd

In vsftpd.conf:

Do not allow the client to use PORT

port_enable=NO

Use the hostname in the PASV response (DNS must be setup and match!)

pasv_addr_resolve=YES

Enable Passive Mode

pasv_enable=YES

Set the passive port range (1000 ports)

pasv_min_port=20000
pasv_max_port=20999

[SteveITS]

@dhenzler If this is for WordPress to install updates that’s the web server connecting to itself. Generally that’s used when the web server process doesn’t have access to write files. As in, server = localhost. No access from Internet required.

[dhenzler]

@steveits
untrue... the updates come from various providers who are only accessible via Internet. Obviously you don't use WordPress.

I get a response from the failed attempts... On my old firewall I had a Port Forwarded to WAN on port 21 inside and outside... once it hit the Internet it may have gone to some obscure upper port mapping. But that was the config.

I've tried NAT using TrueNAT
just ran through a bunch more trials and NADA !

[johnpoz]

@dhenzler so you want a client behind pfsense to talk to some ftp server out on the internet?

What would that have to do with port forwarding? Or this?

WAN-address to LAN single-address ?
WAN-network to LAN single-address ?

And would have nothing to do anything special on the nat, etc.

A client behind talking passive ftp to some server out on the internet would need no special rules at all. This would work out of the box with default any any rule..

A client behind pfsense wanting to talk active FTP would need the ftp helper/proxy setup.. Since pfsense would have to create the rule for the the data channel to be allowed in from the server. And you would not be able to use ftps, since pfsense would not be able to see the port command that has the port the client wants the ftp server to talk too, nor would it be able to correct the client IP to the public IP of pfsense..

And then you would have to configure the package for your use.. Which interfaces, etc..

[SteveITS]

@dhenzler said in FTP for WordPress - How ?:

Obviously you don't use WordPress

Well, we do host many WordPress sites in our data center for our clients...

https://wordpress.org/support/article/updating-wordpress/#automatic-background-updates
"Most sites are now able to automatically apply these updates in the background. If your site is capable of one-click updates without entering FTP credentials, then your site should be able to update ..."

and
https://wordpress.org/support/article/updating-wordpress/#file-ownership
"WordPress determines what method it will use to connect to the filesystem of your server based on the file ownership of your WordPress files. If the files are owned by the owner of the current process (i.e., the user under which the web server is running), and new files created by WordPress will also be owned by that user, WordPress will directly modify the files all by itself, without asking you for credentials.

WordPress won’t attempt to create the new files directly if they won’t have the correct ownership. Instead, you will be shown a dialog box asking for connection credentials. It is typical for the files to be owned by the FTP account that originally uploaded them. To perform the update, you just need to fill in the connection credentials for that FTP account."

What you seem to be pursuing is having the Internet connect to an FTP server behind your router, which is not necessary for WordPress to install WP or plugin updates, and should be avoided for security reasons because the Internet will immediately start password guessing.

In most WordPress web hosting scenarios nowadays the PHP process runs as the web site user which gives it permission to modify the files of that user, meaning the files of the web site. If not, WordPress prompts for FTP credentials so it can connect to that same web server (itself) and "upload" files.

[johnpoz]

@steveits said in FTP for WordPress - How ?:

WordPress prompts for FTP credentials so it can connect to that same web server (itself) and "upload" files.

If the server running wordpress is trying to ftp to itself.. That would have zero to do with pfsense port forwards or nat or ftp anything..

Unless your trying to access some fqdn that points to pfsense wan IP? Or your public IP directly on pfsense. But in that scenario your going to run into nat reflection issues, etc.

If your goal is for wordpress to ftp to itself. You should have it point to its actual local IP or 127.0.0.1 etc.. or some fqdn that resolves to its local IP..

FTP works just fine through pfsense, be it active or passive - but depending what your doing be talking to ftp server out on the public internet, or allowing clients from the internet into your server behind pfsense running ftp.. You have to understand how active and passive differ, and what your actually using.

I would be happy to help you - but you need to be clear on what your doing. Where is the client, where is the server, are you using active or passive. And if this really is some application on some server behind pfsense trying to talk to itself - that throws in some other variables for sure. Need to clearly understand what your doing to help you.

But at a loss to why wordpress would have to ftp to itself? That just seems insane to be honest..

[SteveITS]

@johnpoz said in FTP for WordPress - How ?:

at a loss to why wordpress would have to ftp to itself?

Take a look at the WP doc page I quoted above. WordPress by default tries to auto-update minor versions (5.6.2 to 5.6.3). It can also update plugins. To do so it needs to write to files on the web server. Looking at this from the hosting company's perspective, if PHP is running as that customer's account, then it can write files. This is normally how various PHP-as-CGI options work in the web site hosting settings.

If it's running as, say, an Apache module, it runs as a different account and can't write to anything in the customer account (because one wouldn't want PHP to be able to write to any account on the web server). WordPress can detect that and then prompts to connect to itself via FTP, presuming the customer can connect via FTP and upload files to their own web site. So it's basically a workaround to be able to allow it to update itself.

[johnpoz]

@steveits said in FTP for WordPress - How ?:

So it's basically a workaround to be able to allow it to update itself.

Ah - so when say running on a hosted solution.

Is that what the OP is trying to do, host multiple wordpress stuff on a server behind pfsense for multiple accounts?

[SteveITS]

@johnpoz Even one WordPress site works this way. It's about how the PHP process is running. In the olden days it was faster to run as an Apache module because running as CGI was one process per site and if it wasn't persistent (lots of RAM for hundreds or thousands of sites cheap hosting companies squeeze onto each web server) there was no opcode caching. Now usually it is run as FPM, or FastCGI. But even CGI would work for one site...they key is having PHP run as the file owner so it can update files on the web site.

Basically, "I can't write files, but if I FTP to myself I can so let's do that."

So as long as we're talking about WordPress installing updates to WordPress or its plugins, what OP definitely does not want to do is to allow FTP logins from the Internet.

[johnpoz]

@steveits said in FTP for WordPress - How ?:

what OP definitely does not want to do is to allow FTP logins from the Internet.

I would concur with that for sure... My take is he is running into some sort of reflection problem where he is attempting to ftp to the sites public IP (on the pfsense wan).

I haven't run wordpress for years and years, and it was always on a hosted solution.. I could always fire it up on my local network to test and see what exactly is needed for it to work..

[dhenzler]

@steveits
It worked flawlessly with my Cisco RV-130 firewall
What more do I need to say...

[dhenzler]

@johnpoz

If I can't host it myself, I don't do it ! Simple as that... I like knowing how to fix stuff that I use.

I'm surprised that no one else has had this issue. WordPress is still highly used eh?

[dhenzler]

@steveits
I'm self hosted, and it worked flawlessly when I was using a Cisco RV-130 firewall.

Go figure !

[SteveITS]

@dhenzler Then I would suggest something changed in the web server config to change how PHP is running. See if it is set to run as FPM, or FastCGI, or CGI, on your web site. Otherwise, as noted try "localhost" or your web server's hostname, with your FTP login and password.

[dhenzler]

@steveits
Things don't generally change by themselves. Unless doing an update killed it... I do apt-update and apt-upgrade periodically.

Just watched a Youtube on the subject, and the guy said this package worked with no additional info added. I'm going to check to see if the update/upgrade killed my ftp. Then will check it again.

[SteveITS]

@dhenzler I think you need to clarify what you're trying to do. Are you trying to have WordPress connect to itself to update all things WordPress? Or have external users connecting to your FTP server?

[dhenzler]

@steveits

I'm trying to restore the plugin update (using ftp or ftps) as prescribed by the WordPress software. This more or less automatically accesses the update info (over WAN) and completes the update.

This is all controlled by Wordpress, the only thing you need to do is provide your WAN IP and login / passwd for ftp

[SteveITS]

@dhenzler I think your misconception is that no one connects to your web server to install updates. WordPress connects to its own server. Try localhost as the FTP server and see if it works.

[dhenzler]

@steveits

localhost doesn't have Internet access...

I'm absolutely sure that it works when the port is open. I've had to move on to other issues like a fence that burned down in a neighbors out of control weed burn...

Maybe continue at another time.

Thanks