Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    PFSense blocks FTP Passive traffic

    Firewalling
    3
    3
    1281
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      Stendec75 last edited by

      Hi,

      I would like to use an FTP server behind a PFSense firewall. I could use SFTP (that works), but I would like to use FTPS in PASV mode. The FTP server has been configured to only use port 50001 - 50100 for PASV communication. FTP details shows thats oke, but it looks like PFSense still blocks port 50001 - 50100.

      I have added a Firewall Rule (on LAN tab) IPv4 - TCP/UDP Source: * Port: * Destination:* Port 50001 - 50100 Gateway: *

      STATUS:>  [10/23/2015 5:10:49 PM] Getting listing ""…
      STATUS:>  [10/23/2015 5:10:49 PM] Resolving host name ftp.server.com…
      STATUS:>  [10/23/2015 5:10:49 PM] Host name ftp.server.com resolved: ip = 46.x.x.x.
      STATUS:>  [10/23/2015 5:10:49 PM] Connecting to FTP server… ftp.server.com:21 (ip = 46.x.x.x)...
      STATUS:>  [10/23/2015 5:10:49 PM] Socket connected. Waiting for welcome message…
      [10/23/2015 5:10:49 PM] 220 ProFTPD 1.3.5a Server (ProFTPD) [192.168.1.200]
      STATUS:>  [10/23/2015 5:10:49 PM] Connected. Authenticating…
      COMMAND:> [10/23/2015 5:10:49 PM] AUTH SSL
      [10/23/2015 5:10:49 PM] 234 AUTH SSL successful
      STATUS:>  [10/23/2015 5:10:49 PM] Establishing SSL session…
      STATUS:>  [10/23/2015 5:10:49 PM] Connected. Exchanging encryption keys…
      Session Cipher: 0 bit
      STATUS:>  [10/23/2015 5:10:49 PM] SSL Connect time: 78 ms.
      STATUS:>  [10/23/2015 5:10:49 PM] SSL encrypted session established.
      COMMAND:> [10/23/2015 5:10:49 PM] PBSZ 0
      [10/23/2015 5:10:49 PM] 200 PBSZ 0 successful
      COMMAND:> [10/23/2015 5:10:49 PM] USER userftp
      [10/23/2015 5:10:49 PM] 331 Password required for userftp
      COMMAND:> [10/23/2015 5:10:49 PM] PASS *****
      [10/23/2015 5:10:49 PM] 230 User userftp logged in
      STATUS:>  [10/23/2015 5:10:49 PM] Login successful.
      COMMAND:> [10/23/2015 5:10:49 PM] SYST
      [10/23/2015 5:10:49 PM] 215 UNIX Type: L8
      STATUS:>  [10/23/2015 5:10:49 PM] Host type detected: Unix.
      COMMAND:> [10/23/2015 5:10:49 PM] PWD
      [10/23/2015 5:10:49 PM] 257 "/" is the current directory
      STATUS:>  [10/23/2015 5:10:49 PM] Home directory: /
      COMMAND:> [10/23/2015 5:10:49 PM] FEAT
      [10/23/2015 5:10:49 PM] Informational Message Only:
      211-Features:
      CCC
      PBSZ
      AUTH TLS
      MFF modify;UNIX.group;UNIX.mode;
      REST STREAM
      MLST modify*;perm*;size*;type*;unique*;UNIX.group*;UNIX.mode*;UNIX.owner*;
      UTF8
      LANG en-US*
      EPRT
      EPSV
      MDTM
      SSCN
      TVFS
      MFMT
      SIZE
      PROT
      211 End
      STATUS:>  [10/23/2015 5:10:49 PM] This site supports features.
      STATUS:>  [10/23/2015 5:10:49 PM] This site supports SIZE.
      STATUS:>  [10/23/2015 5:10:49 PM] This site supports UTF-8.
      STATUS:>  [10/23/2015 5:10:49 PM] This site supports LANG.
      COMMAND:> [10/23/2015 5:10:49 PM] OPTS UTF8 on
      [10/23/2015 5:10:49 PM] 200 UTF8 set to on
      STATUS:>  [10/23/2015 5:10:49 PM] This site can resume broken downloads.
      COMMAND:> [10/23/2015 5:10:49 PM] REST 0
      [10/23/2015 5:10:49 PM] 350 Restarting at 0. Send STORE or RETRIEVE to initiate transfer
      COMMAND:> [10/23/2015 5:10:49 PM] PBSZ 0
      [10/23/2015 5:10:49 PM] 200 PBSZ 0 successful
      COMMAND:> [10/23/2015 5:10:49 PM] PROT P
      [10/23/2015 5:10:49 PM] 200 Protection set to Private
      COMMAND:> [10/23/2015 5:10:49 PM] PASV
      [10/23/2015 5:10:49 PM] 227 Entering Passive Mode (192,168,1,200,195,122).
      STATUS:>  [10/23/2015 5:10:49 PM] Substituting received PASV address 192.168.1.200 to server address 46.x.x.x.
      COMMAND:> [10/23/2015 5:10:49 PM] LIST
      STATUS:>  [10/23/2015 5:10:49 PM] Connecting FTP data socket… 46.x.x.x:50042...
      ERROR:>  [10/23/2015 5:11:10 PM] The connection failed due to an error or timeout.

      Any help could be usefull. I have tried the PFSense KB, but I can't fix it using this information. Thanks!

      1 Reply Last reply Reply Quote 0
      • D
        doktornotor Banned last edited by

        https://forum.pfsense.org/index.php?action=search
        https://doc.pfsense.org/index.php/FTP_without_a_Proxy

        @Stendec75:

        I have tried the PFSense KB, but I can't fix it using this information. Thanks!

        Yeah, you need to re-read it until you understand that you must configure your FTP server to stop sending this RFC1918 BS to clients:

        [10/23/2015 5:10:49 PM] 220 ProFTPD 1.3.5a Server (ProFTPD) [[color=red]192.168.1.200]
        [10/23/2015 5:10:49 PM] Substituting received PASV address 192.168.1.200 to server address 46.x.x.x.

        @Stendec75:

        I have added a Firewall Rule (on LAN tab)

        No. That's NOT where you add the rule. Again, re-read the above docs.

        1 Reply Last reply Reply Quote 0
        • johnpoz
          johnpoz LAYER 8 Global Moderator last edited by

          "but I would like to use FTPS in PASV mode."

          Why I would have to ask…  sftp is so much easier!!!

          But yes as dok points out your doing it wrong, you need to setup your port forwards for your passive range..  And also should setup your ftp server to send out your public IP and not expect client to fix it..

          STATUS:>    [10/23/2015 5:10:49 PM] Substituting received PASV address 192.168.1.200 to server address 46.x.x.x.

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

          1 Reply Last reply Reply Quote 0
          • First post
            Last post