Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    My very last question on ftp and ftp-helper

    Scheduled Pinned Locked Moved NAT
    3 Posts 2 Posters 2.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • B
      bruno
      last edited by

      Hi again,

      I'm using a CARP VIP on WAN to publish an FTP server located in DMZ via ftp-helper. All is fine (thanks to Hoba ;) ) except I see inbound connections to this FTP server from outside as if these were coming from pfSense DMZ interface IP address, which is private. That's a problem actually because I can't ban as*holes which hammer whole day against it stealing bandwidth and resources without banning everyone.

      I'm quite sure I had it showing publics IPs during the many attempts I made to get it working, but maybe I was still playing with 1:1 NAT instead of port-forwarding port 21 and letting ftphelper do the dirty job.

      any tip is really appreciated.. 10x

      1 Reply Last reply Reply Quote 0
      • H
        hoba
        last edited by

        If the ftphelper is involved (which basically is a proxy for ftp) you will see the ocnnections coming from the pfSense. Unless you want to portforward all ports including the passive ftp portranges and make your ftpserver aware if it's real public IP, which means shutting down the ftphelper, you won't be able to see the real public IPs and won't be able to create firewallrules to block them.

        1 Reply Last reply Reply Quote 0
        • B
          bruno
          last edited by

          that makes sense now, I was certainly still using NAT 1:1 at that time without reverse-proxying the ftp server.
          thank you!

          1 Reply Last reply Reply Quote 0
          • First post
            Last post
          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.