2

I've been trying to configure my FTPS server which is behind NAT. so I've opened ports 20, 21 as well as 2120-2180 in my NAT (TCP+UDP) and configured proftpd to use this ports for passive communications.

However, trying to connect using FileZilla leads to the following log: (in french, but quite clear actually)

Statut :    Résolution de l'adresse de heardrones.com
Statut :    Connexion à 93.30.208.56:21...
Statut :    Connexion établie, attente du message d'accueil...
Réponse :   220 ProFTPD 1.3.5 Server (HEAR Server) [93.30.208.56]
Commande :  USER hear_downloader
Réponse :   331 Mot de passe requis pour hear_downloader
Commande :  PASS ********
Réponse :   230 Utilisateur hear_downloader authentifié
Commande :  OPTS UTF8 ON
Réponse :   200 UTF-8 activé
Statut :    Connecté
Statut :    Récupération du contenu du dossier...
Commande :  PWD
Réponse :   257 "/" est le répertoire courant
Commande :  TYPE I
Réponse :   200 Type paramétré à I
Commande :  PASV
Erreur :    Délai d'attente expiré
Erreur :    Impossible de récupérer le contenu du dossier

It times out before even being capable of sending the "PASV" answer ! What could cause this ? The answer to PASV command uses the same port as all other commands (PWD, TYPE ...), so where could it come from ?

Here is the network design :

    Server
        Proftpd, no iptables, fix IP 192.168.0.13
        -> (Wifi)
    ISP Box - French ISP (SFR)
        port transfer 20,21,22,2120-2180 to 192.168.0.13
        -> (optic fiber !)
    Internet

I can give Box settings screenshots and proftpd config files if needed. Connecting from LAN/Localhost works perfectly.

Improve this question
5
  • Are there any firewalls, routers, NAT in front of your server which might be interfering with the PASV response? What happens if you use the ftp(1) command-line client on the same machine as the server (for comparison, as that local host connection wouldn't go through firewalls/routers/NAT). – Castaglia Jun 27 '16 at 1:05
  • @Castaglia There is no firewall/router/nat other than the one i configured in front of my server (as I know, maybe my ISP as it is on a machine in my home and not in a datacenter?). A LAN or local FTP session works perfectly, passive mode gets an answer and data is transferred with no trouble. – Magix Jun 27 '16 at 1:09
  • 1
    Another experiment is to run your server on a port other than 21, e.g. 2121 or 4242. Some network gear which interferes like this only looks for port 21 connections. Plus the fact that ProFTPD responds normally to PASV locally indicates it is not a server issue. – Castaglia Jun 27 '16 at 1:38
  • @Castaglia The FTP server answers when put in passive mode on port 2120... Does it ever use UDP for its connection, as ports 20/21 may only be open in TCP ? I don't see what could block the data transfer other than this ! – Magix Jun 27 '16 at 9:42
  • No, FTP never uses UDP. – Castaglia Jun 27 '16 at 15:38
2

FTP is a horrible protocol. It uses two ports -- one for commands, one for data. This makes it notoriously difficult to NAT, since a router would need to parse the command channel and figure out that a second connection is expected for this FTP conversation. Doing so is ugly, but also the only way to make NAT work with FTP.

FTPS encrypts the command channel, thereby making it impossible for any router to inspect the packets and figure out where the data channel is going to be. Obviously that means it won't be able to account for that then; so when your data channel is initiated by the client (as required by PASV) your NATting router won't know what to do with it. It is not possible to fix this, due to the way FTP works.

Just say no to FTP, and use SFTP or something of the sort instead (which transfers files over an SSH tunnel and therefore requires only one TCP connection). Most graphical FTP clients have support for SFTP too, these days.

Improve this answer
1
  • I could do this, but switching to SFTP is much less scriptable - key exchance can't be done in my configuration, and password-only SFTP doesn't seem to be a thing with SCP, so I'm stuck in a rut right now... :/ – Magix Jun 30 '16 at 18:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.