Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Ftp server behind pfsense passive transfer problem

    Scheduled Pinned Locked Moved NAT
    9 Posts 4 Posters 20.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      dav63
      last edited by

      Hi,

      I am using pfsense 2.0.1-RELEASE (amd64) built on Mon Dec 12 18:43:51 EST 2011 FreeBSD 8.1-RELEASE-p6

      I have a CentOS ftp server using proftpd service behind pfsense firewall. Pfsense ftp setup is as indicated in Option 1 of pfsense ftp guide with proxy helper set to default value in kernel.

      Using filezilla in Active Mode everything is fine, using in passive mode it works but sometimes there is a server disconnection from server and RETR or MLSD commands fail:

      Error : connection time expired
      Error:         transfer failed

      from the server side the relevant processes are not completing the transfer and expire after the connection timeout. The destination ip address of proftpd processes is the filezilla client public one.

      I tested the file transfer with IPSec VPN connection and it works in both active and passive modes, so I can exclude any proftpd issue.

      Please can you help me finding the issue?

      1 Reply Last reply Reply Quote 0
      • D
        dav63
        last edited by

        Hi,

        I have fixed the issue:

        1. Added NAT Outbound Rule for port forwarding with range for passive ftp, I defined same range in  proftpd server configuration file (50000 - 60000)
        2. Disabled proxy ftp helper from kernel

        now it works perfectly!

        Thxs for help!

        1 Reply Last reply Reply Quote 0
        • H
          Hemant
          last edited by

          How do you forward FTP port for public IP??

          1 Reply Last reply Reply Quote 0
          • D
            dav63
            last edited by

            I forward port 20 (data) and 21 with NAT rules from Wan interface to the lan ip address of ftp server

            1 Reply Last reply Reply Quote 0
            • H
              Hemant
              last edited by

              Which version of pfsense you ?
              I open 20 and 21 port but it still having problem.
              actually i can log in but
              I have flowing error

              Status: Connection established, waiting for welcome message…
              Response: 220 ProFTPD 1.3.4a Server (my.freenas.com FTP Server) [192.168.2.105]
              Command: USER PravinI
              Response: 331 Password required for PravinI
              Command: PASS *******
              Response: 230-Welcome to my FTP…test ftp
              Response: 230 User PravinI logged in
              Command: OPTS UTF8 ON
              Response: 200 UTF8 set to on
              Status: Connected
              Status: Retrieving directory listing...
              Command: PWD
              Response: 257 "/mnt/Datacenter" is the current directory
              Command: TYPE I
              Response: 200 Type set to I
              Command: PASV
              Response: 227 Entering Passive Mode (192,168,2,105,22,34).
              Status: Server sent passive reply with unroutable address. Passive mode failed.
              Command: PORT 192,168,2,207,41,66
              Response: 500 Illegal PORT command
              Error: Failed to retrieve directory listing
              Status: Disconnected from server

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by

                "I forward port 20 (data)"

                So clearly you don't understand the basics of how the ftp protocol works in the first place.

                In what scenario with a ftp server behind pfsense and someone accessing it from the public side would unsolicited traffic inbound to pfsense wan have a dest port of 20??

                Never is when.

                I highly suggest you understand how ftp works before you go forwarding ports.

                http://slacksite.com/other/ftp.html

                @hemat your connecting to a Private IP there 192.168.2.105, and your using passive so the server told you to connect to 192.168.2.105 at port 22*256 + 34, look like your client said screw that thats not a routable address – which is correct since its private.  And then port command that told the server to connect back to itself at 192.168.2.207 -- so where do you think you need to have any firewall rules here.. Look to me like yoru client and ftp server are on the same network.. How would pfsense even come into play?

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                1 Reply Last reply Reply Quote 0
                • H
                  Hemant
                  last edited by

                  Hi;
                  thanks for link.
                  i attached two screenshot; can you have any idea where i wrong?
                  I can use FreeNAS for ftp and PFsense is the Firewall.

                  Untitled.png
                  Untitled.png_thumb
                  Untitled1.png
                  Untitled1.png_thumb

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator
                    last edited by

                    And again hemant – how does pfsense even come into play??  Your box is on the same network as the ftp server from the ips listed - pfsense would not even be in the conversation between two boxes on the same segment.  From your posted ftp session it looks like 192.168.2.207 is talking to server on 192.168.2.105..  Why would pfsense be involved in that conversation?

                    But from your rules there - you have MULTIPLE pubic IPs?  So say I come in public IP A, now when my ftp server goes to make the connection back to the client..  What public IP will I use, maybe its B?  If so the client would normally tell me to F off..  Since his ftp helper and just normal nat would expect the traffic from the same ip it talked to for the ftp server address.

                    Also the ftp helper when used will change the IP to public, if your going to turn off the helper than you need to make sure that the ftp server returns its public IP..  Same goes for the client in a active connection.

                    Again understanding the protocol is the first step - and understanding if your even using your firewall is step 2?  Look at your conversation you posted..  Where is pfsense involved in that conversation between 2 boxes on the same segment?  Did you use nat reflection to access the server, ie via your public IP and you have the helper off so it returned the Private IP in the banner?  Don't test port forwards using nat relection..  Get someone from outside your network to test - if you send me info, I would be happy to test your ftp server for you.

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    1 Reply Last reply Reply Quote 0
                    • B
                      boohoo
                      last edited by

                      @dav63:

                      Hi,

                      I have fixed the issue:

                      1. Added NAT Outbound Rule for port forwarding with range for passive ftp, I defined same range in  proftpd server configuration file (50000 - 60000)
                      2. Disabled proxy ftp helper from kernel

                      now it works perfectly!

                      Thxs for help!

                      It worked in the beginning but did some changes and I can never get it to work again.

                      Fowards range from 2000-2020 > ftp server port 2000

                      ftp server listen on port 2000 and passive is 2000-2020
                      I also have set debug.pfftpproxy = 1

                      version of pfsense
                      2.0.3-RELEASE (amd64)
                      built on Fri Apr 12 10:27:56 EDT 2013
                      FreeBSD 8.1-RELEASE-p13
                      Can't get it work.

                      EDIT…. it seems that when I did an update it was corrupted.. did a fresh install it was good to go.

                      1 Reply Last reply Reply Quote 0
                      • First post
                        Last post
                      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.