Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    FTP issue going through 2 pfSense/NATs

    NAT
    3
    8
    1184
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      dbennett last edited by

      Greetings,

      I'm running into an issue with my FTP clients connecting to a public FTP server through 2 pfSense firewalls via PASV TLS.

      Ex;  WAN  |  DMZ  |  OFFICE    each '|' is a pfsense

      I'm able to connect from the DMZ but not form the office.

      Any thoughts?

      Thanks

      1 Reply Last reply Reply Quote 0
      • KOM
        KOM last edited by

        I'm running into an issue… Any thoughts?

        What exactly is the issue?  What error do you get when trying to connect via office?

        1 Reply Last reply Reply Quote 0
        • johnpoz
          johnpoz LAYER 8 Global Moderator last edited by

          yeah fix your network so your not behind 2 freaking nats..  Use active ftp..  Or better yet use sftp.

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.01

          1 Reply Last reply Reply Quote 0
          • D
            dbennett last edited by

            I find it interesting that more often than not people assume our network is 'broken' without even understanding the full scope of the infrastructure and the reasons why it is the way it is…  With that said, I respect your opinion.

            And as for the ftp to sftp, I'm on the client side of this not the server so that is not up to me.

            Here is the error I'm getting:
            GnuTLS error -110: The TLS connection was non-properly terminated
            Server did not properly shut down TLS connection

            There are a total of 3 "CTlsSocket::ContinueHandshake()"  right before the error.

            Thanks for the questions and comments!

            1 Reply Last reply Reply Quote 0
            • johnpoz
              johnpoz LAYER 8 Global Moderator last edited by

              So the public ftp server is NOT behind pfsense.. Its on the internet?

              So it tells your client to connect to some public IP.. Show your ftp log of the connection.

              If the server was behind pfsense, than passive would be an issue.  If its out on the public internet and your behind pfsense - then using passive has no issues..  Unless your client can not even get the control connection to start with.

              Which sounds like that might be your problem.  Do you limit outbound ports?

              But to be honest, 2 nats is broken!!

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.01

              1 Reply Last reply Reply Quote 0
              • D
                dbennett last edited by

                Thanks for your reply!

                I did a packet capture on both the internal and external firewalls when I did the FTP connection from the DMZ and one from the office and it's showing that the DATA connection for the office is not getting through.  I'll have to look through the OUTBOUND NAT again because there are rules in place to allow that range.

                If the outbound NAT rules are are set correctly, would there be any other reason that data connection would get 'lost' / not find its way back through both routers?

                Thanks again?

                1 Reply Last reply Reply Quote 0
                • johnpoz
                  johnpoz LAYER 8 Global Moderator last edited by

                  you wouldn't need to add any outbound nats for passive ftp connections to servers outside pfsense, your normal typical nat that you use to talk to everything else is all that is needed.  If you added nats that is what is broken.

                  you would only need to setup nats when ftp is behind pfsense and clients from internet are talking to it and want to use passive.  then you have to forward the ports its using for passive through.

                  But if this ftp server is out on the internet..  Out of the box pfsense config would allow you to connect via passive.  Active on the other hand would not work without the helper package since the helper was removed from pfsense a while back.

                  I find most issues with ftp come from the person trying to allow it through a firewall, etc. doesn't understand the difference between active and passive and who creates the conversation to who and from what ports, etc.

                  This is a fantastic write up for active vs passive
                  http://www.slacksite.com/other/ftp.html

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.01

                  1 Reply Last reply Reply Quote 0
                  • D
                    dbennett last edited by

                    I get what your saying and that makes total sense.  Thanks!

                    1 Reply Last reply Reply Quote 0
                    • First post
                      Last post