FTP issue going through 2 pfSense/NATs

[dbennett]

Greetings,

I'm running into an issue with my FTP clients connecting to a public FTP server through 2 pfSense firewalls via PASV TLS.

Ex;  WAN  |  DMZ  |  OFFICE    each '|' is a pfsense

I'm able to connect from the DMZ but not form the office.

Any thoughts?

Thanks

[KOM]

I'm running into an issue… Any thoughts?

What exactly is the issue?  What error do you get when trying to connect via office?

[johnpoz]

yeah fix your network so your not behind 2 freaking nats..  Use active ftp..  Or better yet use sftp.

[dbennett]

I find it interesting that more often than not people assume our network is 'broken' without even understanding the full scope of the infrastructure and the reasons why it is the way it is…  With that said, I respect your opinion.

And as for the ftp to sftp, I'm on the client side of this not the server so that is not up to me.

Here is the error I'm getting:
GnuTLS error -110: The TLS connection was non-properly terminated
Server did not properly shut down TLS connection

There are a total of 3 "CTlsSocket::ContinueHandshake()"  right before the error.

Thanks for the questions and comments!

[johnpoz]

So the public ftp server is NOT behind pfsense.. Its on the internet?

So it tells your client to connect to some public IP.. Show your ftp log of the connection.

If the server was behind pfsense, than passive would be an issue.  If its out on the public internet and your behind pfsense - then using passive has no issues..  Unless your client can not even get the control connection to start with.

Which sounds like that might be your problem.  Do you limit outbound ports?

But to be honest, 2 nats is broken!!

[dbennett]

Thanks for your reply!

I did a packet capture on both the internal and external firewalls when I did the FTP connection from the DMZ and one from the office and it's showing that the DATA connection for the office is not getting through.  I'll have to look through the OUTBOUND NAT again because there are rules in place to allow that range.

If the outbound NAT rules are are set correctly, would there be any other reason that data connection would get 'lost' / not find its way back through both routers?

Thanks again?

[johnpoz]

you wouldn't need to add any outbound nats for passive ftp connections to servers outside pfsense, your normal typical nat that you use to talk to everything else is all that is needed.  If you added nats that is what is broken.

you would only need to setup nats when ftp is behind pfsense and clients from internet are talking to it and want to use passive.  then you have to forward the ports its using for passive through.

But if this ftp server is out on the internet..  Out of the box pfsense config would allow you to connect via passive.  Active on the other hand would not work without the helper package since the helper was removed from pfsense a while back.

I find most issues with ftp come from the person trying to allow it through a firewall, etc. doesn't understand the difference between active and passive and who creates the conversation to who and from what ports, etc.

This is a fantastic write up for active vs passive
http://www.slacksite.com/other/ftp.html

[dbennett]

I get what your saying and that makes total sense.  Thanks!