My very last question on ftp and ftp-helper

[bruno]

Hi again,

I'm using a CARP VIP on WAN to publish an FTP server located in DMZ via ftp-helper. All is fine (thanks to Hoba ;) ) except I see inbound connections to this FTP server from outside as if these were coming from pfSense DMZ interface IP address, which is private. That's a problem actually because I can't ban as*holes which hammer whole day against it stealing bandwidth and resources without banning everyone.

I'm quite sure I had it showing publics IPs during the many attempts I made to get it working, but maybe I was still playing with 1:1 NAT instead of port-forwarding port 21 and letting ftphelper do the dirty job.

any tip is really appreciated.. 10x

[hoba]

If the ftphelper is involved (which basically is a proxy for ftp) you will see the ocnnections coming from the pfSense. Unless you want to portforward all ports including the passive ftp portranges and make your ftpserver aware if it's real public IP, which means shutting down the ftphelper, you won't be able to see the real public IPs and won't be able to create firewallrules to block them.

[bruno]

that makes sense now, I was certainly still using NAT 1:1 at that time without reverse-proxying the ftp server.
thank you!