Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    FTP in pfSense 2.0

    Scheduled Pinned Locked Moved 2.0-RC Snapshot Feedback and Problems - RETIRED
    49 Posts 16 Posters 41.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • R
      rpsmith
      last edited by

      just disable my passive port pass rule and was unable to connect via passive FTP so it looks like the rule is still required.

      However, when I re-enabled the rule I got an error message back from pfsense and I couldn't get back into the GUI!  Will try rebooting and see if that helps.

      Edit: I was able to get back in after rebooting.

      Roy…

      1 Reply Last reply Reply Quote 0
      • S
        soconfused
        last edited by

        Testing a client in passive mode with the 1 18 build. Functions until you try to re-initiate a prior connection then the whole machine goes down.

        Each time a hard reboot is required and the file system gets corrupted. The file system gets fixed successfully during the boot sequence. I am not sure if the error has something to to do with the hard reboot or the fault but it is repeatable every time. I had putty log the output if anyone is interested in the gory details.

        I already had a rule for passive FTP in place so nothing changed there.

        Edit: Was running the SMP kernel. Did not see the same behavior with the developer kernel.
        Nothing to do with it. Still crashes.

        1 Reply Last reply Reply Quote 0
        • B
          bEsTiAn
          last edited by

          Hi !

          I confirm it works too…... But not all the time.

          I have a dual-wan setup, and I can connect to my FTP server, passive mode, behind my pfsense, using latest snapshot, but only through one WAN, not through the other one.
          Previously I had forced it manually to work having defined a passive range and unconditionnaly NAT + allow inbound rule. I disabled them all, and it now works through only one WAN.

          N.B.: the so-called WAN that works is not the WAN interface selected in the first setup, it's an additional VLAN, just the same as the one that doesn't work. I mention this because I remember that back in 1.2.x special rules were applied for WAN interface and nowhere else (e.g. spamd package). And to add one more bit of complexity, all these traffics are hitting CARP vIP (for redundancy, I have my 1.2.3 box ready in case 2.0 beta having attitude problems with me :)).

          I can take snapshots or copy/paste parts of my config if needed for clarification.

          Thank you a lot for your hard work (and sorry to give you some more) !

          P.S. : don't know if it's related to the randomly repeated errors "kernel: arpresolve: can't allocate llinfo for x.x.x.x" ? I can't get rid of these permanently.

          1 Reply Last reply Reply Quote 0
          • S
            soconfused
            last edited by

            Testing for FTP client problems today with 2.0-BETA5 (i386) built on Sat Jan 29 23:42:13 EST 2011

            Fresh update with smp kernel: locked up after a few connection attempts. repeated problem twice
            Loaded dev kenel: cannot repeat behavior, connection still hangs sometimes on LIST
            Reloaded smp kernel: same behavior as with dev kernel
            Rebooted: works great. no connection hangs.
            Ideas?

            1 Reply Last reply Reply Quote 0
            • jimpJ
              jimp Rebel Alliance Developer Netgate
              last edited by

              That's currently a known issue. It hangs the box with everything except a dev kernel.

              Some more patches went in to try to fix it before the builds from Saturday, but it still hangs for me.

              Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

              Need help fast? Netgate Global Support!

              Do not Chat/PM for help!

              1 Reply Last reply Reply Quote 0
              • V
                vadonka
                last edited by

                The problem is still persist with the latest build 2011.02.01. I have a single WAN connection but i use many virtual IF alias. I have multiple ftp server behind NAT, forwarded the default tcp port: 21 and a passive port range (from different IF alias). If i try to passive FTP from masqued client machine to outside the pfsense box instant freeze. Nothing help but cold reset. This is a serious problem, i need to revert the whole system to 1.2.3 because of this issue (reinstall a fresh 1.2.3 and restore the configuration).

                1 Reply Last reply Reply Quote 0
                • jimpJ
                  jimp Rebel Alliance Developer Netgate
                  last edited by

                  Ermal told me yesterday he has a lead on another possible fix but he needs to test it more before he commits it.

                  Yesterday I was unable to make my VM hang, when I could do it repeatedly on Friday, but I was working with FTP as a client, not a server. (Though I still saw FTP failures where the LIST command would hang the connection, it just didn't hang the OS)

                  Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                  Need help fast? Netgate Global Support!

                  Do not Chat/PM for help!

                  1 Reply Last reply Reply Quote 0
                  • V
                    vadonka
                    last edited by

                    if i delete all the NAT rules what is forward port 21 to internal FTP server then the box not freeze. i think the problem is complicated. internal FTP server behind a NAT with forwarded port 21 and FTP connect to anywhere else the standard tcp port 21(!) at the same time cause an instant freeze. if i connect to an ftp server what is not used the default tcp 21 port works like a charm. so i think the problem is the ftp helper kernel module. somehow the nat rule to the internal ftp server and the nat from internal to outside not compatible each other when both use the default tcp 21 port. the only explanations is the kernel module, and this issue freeze the kernel.

                    best option remove that module from the kernel or give an option on the gui to enable/disable ftp helper modul while the problem is permanently fixed. i dont use this module anyway :)

                    here is my enviroment:

                    WAN Address: 193.6.xxx.4
                    IF Alias: 193.6.xxx.13 NAT -> 192.168.9.13 port 21, port 13001-14000 (for passive range)
                    IF Alias: 193.6.xxx.14 NAT -> 192.168.9.14 port 21, port 14001-15000 (for passive range)            
                    IF Alias: 193.6.xxx.15 NAT -> 192.168.9.15 port 21, port 15001-16000 (for passive range)

                    My client PC: 192.168.9.249

                    The pfsense: 192.168.9.1

                    I try to FTP connection from my client PC to 212.92.xxx.12 port 21 (different ISP) with passive mode the pfsense freeze.
                    But if i try to connect to another ftp server what is used port 2121 it works.

                    If i delete all three NAT rules what i describe above, the first scenario works too, so the problem is only the port 21.

                    my home configuration: alix board with embedded pfsense, letest 2.0 beta5 build
                    i use port forward for ftp, but only one nat rule exist and i use single WAN address without if alias. the passive mode ftp failed, hangs on only the listing, but only if i use total commander as client. in the flashfxp passive mode use PASV and it works. so the native passive mode failed only. but not hangs the router.

                    the box freeze only when multiple if alias exist, multiple nat to multiple internal ftp server on the same interface and client connect from internal to external ftp at the same time use the default ftp port. i think it is definetly connected to ftp proxy kernel modul.

                    i try to use carp instead of if alias, but the box freeze again, so this is irrevelant.

                    sorry for my bad english, i wish i can help you to solve this issue :)

                    1 Reply Last reply Reply Quote 0
                    • E
                      eri--
                      last edited by

                      It should be fixed on snapshots of tomorrow.

                      1 Reply Last reply Reply Quote 0
                      • V
                        vadonka
                        last edited by

                        @ermal:

                        It should be fixed on snapshots of tomorrow.

                        thank you! that was fast :)

                        1 Reply Last reply Reply Quote 0
                        • V
                          vadonka
                          last edited by

                          can i try to update a new snapshot? it is possible to fix this issue?

                          1 Reply Last reply Reply Quote 0
                          • E
                            eri--
                            last edited by

                            All should be fixed on snapshots from today on.

                            1 Reply Last reply Reply Quote 0
                            • V
                              vadonka
                              last edited by

                              i will try, and i post the results to here.

                              update: it is working! thanks again!

                              1 Reply Last reply Reply Quote 0
                              • F
                                FisherKing
                                last edited by

                                Just got around to testing this, but I wanted to also confirm that FTP / pfSense appears to be working.

                                I tested external server & internal client, external client & internal server, internal client & internal server.

                                EDIT: running 2.0-BETA5 (i386) built on Wed Feb 9 00:54:34 EST 2011

                                1 Reply Last reply Reply Quote 0
                                • P
                                  phb.fr
                                  last edited by

                                  Hi,

                                  With Pfsense 2.0 RC1 [built on Mon Mar 7 12:03:17 EST 2011 ]

                                  FTP with Passif mode work like charm (with pfftpproxy)..

                                  But, on active mode, if client have "low" port for connect to ftp (< 3000 ?) all work like charm.
                                  if client have high port (> 50.000) ftp client not show directory
                                  (Freeze a LIST command)

                                  I use propriotary software how working ONLY with Active mode :(

                                  1 Reply Last reply Reply Quote 0
                                  • P
                                    phb.fr
                                    last edited by

                                    Hi,

                                    I am going crazy, but i understand why ftp work for someone and not for other.

                                    1 client with 2 machines (On otherWAN)
                                    1 - windows 2k3
                                    1 - Windows 2k8
                                    Client use ftp.exe
                                    –-->Dlink xDSL router ----> Internet  ------My Pfsense -----> Lan FTPServer

                                    Windows2003 on active mode work
                                    Windows2008 on active mode connection ok but at LS command "freeze" and after waiting 2 min "timeout"

                                    Note : no Firewall on windows2008, no special rules ont DLINK.
                                    On windows2003 ftp client trying to talk on port 2085
                                    On windows2008 ftp client trying to talk on port 50058

                                    No special rules on pfsense (Only forward port 21 to FTPLAN)

                                    Note : If i NOT use pfsense but shorewall/iptables/ ip_conntrack_ftp on linux
                                    (win2K3 AND win2K8 machines is working !)

                                    Maybe pfftpproxy bug or windows 2k8 R2 specific TCP pile ?

                                    Help me

                                    1 Reply Last reply Reply Quote 0
                                    • E
                                      eri--
                                      last edited by

                                      Just provide a pfctl -vss of this when it happens.

                                      1 Reply Last reply Reply Quote 0
                                      • P
                                        phb.fr
                                        last edited by

                                        IP_PublicWindowsClient –> Internet IP from client (Windows2k3 and Windows 2k8)
                                        IPFTPLAN ---> Ip local (192.168.x.x where my ftp server)
                                        IP_PublicFTP --> My Public IP
                                        Note :  bge0 Is LAN

                                        With Windows2K3 (Working)
                                        all tcp IPFTPLAN :21 <- IP_PublicFTP:21 <- IP_PublicWindowsClient:2246       ESTABLISHED:ESTABLISHED
                                        all tcp IP_PublicWindowsClient:2246 -> IPFTPLAN :21       ESTABLISHED:ESTABLISHED
                                        bge0 tcp IP_PublicWindowsClient:2250 <- IPFTPLAN :20       FIN_WAIT_2:FIN_WAIT_2
                                        all tcp IPFTPLAN :20 -> IP_PublicFTP:48730 -> IP_PublicWindowsClient:2250       FIN_WAIT_2:FIN_WAIT_2

                                        With Windows2k8 not work
                                        pfctl -vss | grep IP_PublicWindowsClient
                                        all tcp IPFTPLAN :21 <- PublicFTP :21 <- PublicWindowsClient:49756       ESTABLISHED:ESTABLISHED
                                        all tcp PublicWindowsClient :49756 -> IPFTPLAN :21       ESTABLISHED:ESTABLISHED
                                        all tcp IPFTPLAN :20 -> PublicFTP:33868 -> PublicWindowsClient :49757       SYN_SENT:CLOSED

                                        Thank for your help

                                        Edit : No idea ermal ?

                                        1 Reply Last reply Reply Quote 0
                                        • P
                                          phb.fr
                                          last edited by

                                          Test with 2.0RC1 15 Mar.

                                          Same Problem.

                                          1 Reply Last reply Reply Quote 0
                                          • E
                                            eri--
                                            last edited by

                                            Can you provide me traffic captures when this happens!
                                            It seems strange that the same protocol does not work for different versions of Windows?

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.