FTP problems

Goo

Hey guys

I'm newish to pfSense and we went from a single connection box to using the LB. Ever since then i can't connect via FTP.

We have 2 ADSL connections which are connected via 2 modems that are using NAT and we have two WAN interfaces ("WAN" and "TPG") with local IPs (10.10.20.1, 10.10.30.1)

I've tried creating rules to force FTP traffic (Ports 20 & 21) and any traffic between ports 1024:65535 through a specific interface.

I've also turned the FTP proxy thing in Interfaces menu on and off for all the interfaces

When i ftp out , the client netstat table just shows SYN_SENT on port 21.

At the moment, our TPG connection is temperamental so we have disabled the LB. FTP is still not working.

Some of my rules have been omitted from these lists, if you think they might be relevant please let me know.

Here is my WAN rule table:
TCP/UDP * * 10.10.10.10 873 * NAT RSYNC -> NAS
TCP * * 10.10.10.253 25 (SMTP) * NAT Mail -> Proxy
TCP * * 10.10.10.6 22 (SSH) * NAT iiNET SSH -> Tintin
TCP * * 10.10.10.9 3389 (MS RDP) * NAT iiNET RDP -> XP
TCP * 80 (HTTP) 10.10.10.6 80 (HTTP) * NAT iiNet Web -> Tintin

Here is my TPG rule table:

TCP * * 10.10.10.253 22 (SSH) * NAT iiNET SSH -> Proxy
TCP/UDP * * 10.10.10.10 873 * NAT RSYNC -> NAS

Here is my LAN rule table:

UDP * * * 27000 - 27020 iiNet STEAM (UDP) -> iiNet
TCP * * 208.113.148.18 * iiNet Dreamhost -> iiNet
TCP * * 203.59.27.133 * iiNet ftp.iinet.net.au -> iiNet
TCP * * * 21 (FTP) iiNet FTP -> iiNet
TCP * * * 1024 - 65535 iiNet Everything -> iiNet
TCP * * * 20 iiNet FTP data -> iiNet
TCP * * 203.59.27.13 * iiNet games.iinet.net.au -> iiNet
TCP * * * 25 (SMTP) iiNet Mail -> iiNet
ICMP * * * * iiNet ICMP
ICMP * * * * TPG ICMP
TCP * * * 443 (HTTPS) iiNet LAN -> HTTPS -> iiNet

LAN net * 10.10.20.0/24 * iiNet LAN -> iiNet ADSL Modem
LAN net * 10.10.30.0/24 * TPG LAN -> TPG ADSL Modem
TCP LAN net * * * iiNet iiNet/TPG LoadBalancer
TCP/UDP 10.10.10.253 * * 161 (SNMP) * Nagios -> SNMP

Here is my NAT table:

TPG TCP/UDP 873 10.10.10.10(ext.: 10.10.30.1) 873 RSYNC -> NAS
WAN TCP/UDP 873 10.10.10.10(ext.: 10.10.20.1) 873 RSYNC -> NAS
WAN TCP 25 (SMTP) 10.10.10.253(ext.: 10.10.20.1) 25 (SMTP) Mail -> Proxy
WAN TCP 22 (SSH) 10.10.10.6(ext.: 10.10.20.1) 22 (SSH) iiNET SSH -> Tintin
TPG TCP 22 (SSH) 10.10.10.253(ext.: 10.10.30.1) 22 (SSH) TPG SSH -> Proxy
WAN TCP/UDP 80 (HTTP) 10.10.10.9(ext.: 10.10.20.1) 80 (HTTP) Web -> Tintin

hoba

When using multiwan ftp will only work if you add a firewall rule at lan to send all traffic to destination 127.0.0.1 to the default gateway and enable the ftphelper at lan. ftp-traffic will only work on the original wan interface then.

Goo

For ftp port? When u said default GW, do you mean the gateway item "Default", or "LB"??

So would the rule look like this? :

TCP * * * 21 (FTP) * FTP

hoba

please reread more closely ;)
at firewall>rules, lan, very top of the rules: any protocol, any source, destination 127.0.0.1, gateway "default"

save, apply, maybe reset states if it does not work immediately.

Goo

I read your post, i just didn't fully understand what to do.

I've done that, when u say enable the ftp helper on the Lan interface, do you mean make sure this thing is unticked?:

FTP Helper Disable the userland FTP-Proxy application

hoba

right, the logic is reversed. it should be running on lan so don't disable it ;)

Goo

OK -it works thx very much :)

Is this ftp helper anything like the iptables conntrack_ftp module ?

hoba

ftp uses more than one port. the proxy is dynamically openening ports by listening what ports the client and the server request/assign. if the proxy is not in use it's most likely that the different ports that belong to the same session are getting balanced which will break stuff as the source IPs for the same session are different. as the proxy is living on 127.0.0.1 you have to make sure with that rule that the ftp traffic reaches the proxy and is not sent out directly to one of the wans.

Goo

Thanks for that- very helpful

While i got you here, quick question - is there any way to we can get Nagios to monitor pfSense? I've looked around but the SNMP stuff seems mostly performance & stats related

Thanks