Pftpx and RFC 959



  • Hi,

    I have a ftp server behind a pfSense firewall and ftp from WAN to LAN works fine except active ftp.
    The pftpx proxy connects in active mode with a high source port instead of port 20 according to RFC 959.
    It's remarkable for me since pfSense takes care (even with a workaround) of clients that violates RFC 959 but itself…

    After searching and reading the source code of pftpx I've found an undocumented "-r" option that activates the "rfc_mode".
    I've restarted all pftpx processes with "-r" and the data connection came from port 20.

    How can I configure pfSense to use this option for all pftpx processes?



  • Hi,

    I've found a solution from this topic http://forum.pfsense.org/index.php/topic,9016.msg51238.html#msg51238.

    After changing line 1017 in /etc/inc/filter.inc from:
    $after_filter_configure_run[] = "/usr/local/sbin/pftpx {$shaper_queue}-f {$target} -b {$external_address} -c 21 -g 21";
    to:
    $after_filter_configure_run[] = "/usr/local/sbin/pftpx {$shaper_queue}-f {$target} -b {$external_address} -c 21 -g 21 -r";
    it works as expected.


Log in to reply