Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Need help with ftp problem.

    Scheduled Pinned Locked Moved
    Routing and Multi WAN
    5
    8
    3.7k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • R
      Richb
      last edited by

      I setup load balancing and failover with 1.2-BETA-1-TESTING-SNAPSHOT-05-09-2007
      built on Fri May 11 16:38:55 EDT 2007.  When i try to connect to a ftp site using passive mode or active mode it logs in fine but hangs on the directory list.  I've searched the forum for solutions and tried several.  Don't know it this helps.

      Firewall: Rules
        LAN        WAN        IPSEC        PPTP VPN        SHAW   
          Proto Source Port Destination Port Gateway Schedule Description   
        *  LAN net  *  64.59.128.220  *  24.66.224.1    Mail out through Shaw   
        *  LAN net  *  127.0.0.1  *  *
        TCP  LAN net  *  *  HTTPsAll  ShawFailoverWan
        *  LAN net  *  *  *  WanBalanceShaw    Load Balance Telus & Shaw   
        *  LAN net  *  *  *  WanFailoverShaw    Telus Failover to Shaw   
        *  LAN net  *  *  *  ShawFailoverWan    Shaw Failover to Telus   
        *  LAN net  *  *  *  *    Default LAN -> any

      Everything else seems to work fine including all 10 vpn connections.  I think I've gone brain dead.
      Any help would be appriciated.

      Thanks
      Richard

      1 Reply Last reply Reply Quote 0
      • S
        sullrich
        last edited by

        FAQ. Load balancing is not compatible with FTP currently.  Search the forum for more information.

        1 Reply Last reply Reply Quote 0
        • dotdashD
          dotdash
          last edited by

          I'm using the workaround for outbound ftp on dual-wan. My LAN rule for 127.0.0.1 is TCP, don't know if it makes a difference. Also, did you make sure ftp helper is enabled on LAN and disabled on WANs?

          1 Reply Last reply Reply Quote 0
          • R
            Richb
            last edited by

            Thank you dotdash

            That last tip seems to of done it.  I was screwed up on the ftp helper.  I had the lan side disabled.
            And thanks for the quick response from both of you.

            Richard

            1 Reply Last reply Reply Quote 0
            • K
              krull
              last edited by

              Greetings,

              Just to add to this note, The doc.pfsense.org Wiki Entry for Load Balancing clearly states that the FTP Helper SHOULD be checked, but obviously this is incorrect. It should be amended since it's misleading.

              Sticking with the wiki examples (LAN+WAN+WAN2) the FTP Helper setting is as follows:

              LAN: ENABLED
              WAN: DISABLED
              WAN2: DISABLED

              This works as stated by dotdash. Cheers!

              1 Reply Last reply Reply Quote 0
              • P
                Pootle
                last edited by

                I'm re-doing the multiWAN wiki at the moment to tidy it up, get the rules better sorted out, I'll get the FTP changes in there as well.

                It's here http://doc.pfsense.org/index.php/MultiWanVersion1.2  if you want to check for any other changes I should make…....  (its also linked from the main load balance page)

                I'm planning to base the rules on this info from Hoba  ;D

                • destination 127.0.0.1 default gateway (workaround ftphelper and such)
                • destinations ipsecsubnets default gateway (otherwise traffic will be routed around the tunnelentrypoint, not covered yet in the tutorial)
                • destination ports https and such failoverpool wan->opt1 (protocols that have problems when hopping between IPs)
                • destination any loadbalancer pool wan-opt1 (catch al other traffic)

                Presumably the https fix thing won't be needed if sticky is used - is sticky likely to make it into 1.2?

                1 Reply Last reply Reply Quote 0
                • K
                  krull
                  last edited by

                  Hi Pootle,

                  Just skimmed through your revision, and it looks promising! Great job so far!

                  I just finalized my DualWan setup here. I think it's ill advised to go with the Alias route like the original wiki did unless it is explained a little further in-depth as alot of people here really screwed things up due to that.

                  I also noticed in your revision that you stuck with the original wiki's 'router mode' versus the 'bridge mode' in the Setting up your modem section. May I suggest you add a remark and/or additional information for those who use Static IPs in 'bridge mode' as well. This way the wiki's thorough and would not confuse first timers such as myself who happened to have two different ISPs with bridge-static-IP-modems to tinker with. (I had to think OTB whilst reading the original wiki based on my setup…)

                  Also concerning the DNS Forwarder setup and those who host servers in-house (like myself...). I noticed the original wiki did not take this into account and for some reason my internally hosted webserver would not resolve to its TLD domain-name if accessed from LAN. I had to explicitly state in the DNS Forwarder the TLD domain-name of my webserver for it to resolve correctly.

                  I think these are the only footnotes I got from the top of my head. Hope this helps... Cheers!

                  1 Reply Last reply Reply Quote 0
                  • P
                    Pootle
                    last edited by

                    @krull:

                    I think it's ill advised to go with the Alias route like the original wiki did unless it is explained a little further in-depth as alot of people here really screwed things up due to that.

                    Thanks for the feedback Krull, take your point, how about just 1 aliase for https etc. ports that tend to get upset by load balancing - the others are of les value, but without this one, several rules would be required?

                    I'll see what I can do about the other bits - DNS definitely, I do it that way myself, but bridge mode I have limited knowledge of  ::)

                    1 Reply Last reply Reply Quote 0
                    • First post
                      Last post