2

I'm trying to access my ftp server through the browser but I am facing an issue.

If I access it using Filezilla, I can see the directories fine. However using a browser I get no directory listing as you can see in here: http://www.imageurlhost.com/images/2ki5heahncml7517tcbg.png

I have added this entry to iptables hoping to solve the problem but it didn't change:

-A INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT
3

The simple solution is to switch Filezilla to use passive mode when connecting to that FTP server.

When you connect to FTP you use port 21 which is known as the control channel. This is the connection used to send commands and receive notifications on the results of the commands issued. Note that for file listings (the output to LIST), file transfer (fetching files RETR and putting files STOR) and other operations that actually requires transmission of data, a separate channel known as the the data channel is created. FTP can operate this data channel in either of two modes, active or passive. Both of these refer to how the data channel is established.

You issue a LIST (in active mode)

CLIENT                                 FIREWALL                              FTP SERVER
                                          _              (port 21)                _
 __  _               (port 21)           |=| ---------- LIST command --------->  |=|
[__]|=|  ----- LIST command issued -- >  |=|                                     |=|
/::/|_| .                                |_| <----- FTP server attempts to ----  |_|
        `\___ now listening on arbitrary            connect and gets denied
              port for data channel say 8000             by firewall

In active mode the client advertises an arbitrary listening port it creates and the FTP Server connects to this advertised address and port on the client machine. This is normally where firewalls block the traffic because it is to a random (often changing) high order port number on the client host advertising the FTP data channel. Filezilla defaults to using a port in between 6000 and 7000. If the firewall does not block this connection the output of the LIST command is then transferred over this separate channel.

You issue a LIST (in passive mode)


CLIENT                             FIREWALL                               FTP SERVER
                                       _              (port 21)                _
 __  _            (port 21)           |=| ---------- LIST command --------->  |=|
[__]|=| --- LIST command issued -- >  |=|                                     |=|
/::/|_|                               |_| <--- FTP server advertises the ---  |_|
                                               listening data port over     \___ server with
                                                  the control channel         listening data
                                                                                 channel

CLIENT                                 FIREWALL                            FTP SERVER
                                          _              (port 21)             _
 __  _   <--- open control channel --->  |=| ---- open control channel ---->  |=|
[__]|=|                                  |=|                                  |=|
/::/|_|  --- client establishes a ---->  |_| ---- passive data channel ---->  |_|
             connection to the                    connection allowed
             advertised data channel                  by firewall       

In passive mode, the roles are reversed, the FTP client issues a PASV command before the LIST command. The FTP Server then creates a listening TCP port and advertises this for the client to connect to to establish the data channel. This is usually allowed by most firewalls (as clients can make connections outbound to any port).

Note that if there is a firewall in between your FTP server and the internet, this firewall ALSO has to be configured to have these ports opened to allow the passive connections. Most FTP servers provide the ability to set the range in which these ports will be advertised and these can be opened to allow those connections.

If you are restricted and have a client that cannot do passive, Filezilla offers the ability (uned Edit -> Settings... -> Connection/FTP/Active Mode to set which ports to use), and you can then add these to your firewall.

| improve this answer | |
  • Thank you for the reply Drav Sloan. The problem is not with Filezilla, it works fine. The problem is that when I access the ftp server using a browser, there is no directories listed. I used Filezilla as an example that the server is properly configured and works. – HeWhoBuilds Sep 15 '13 at 13:20
  • Most browsers simply use active mode. The restriction here is covered in my post, your web browser advertises a data channel for the server to connect back to, and your firewall blocks this. The only way to get around this is to open a large range of ports for your browser to be visible by your FTP server. – Drav Sloan Sep 15 '13 at 13:43
  • I've also added to the answer that for passive mode the FTP servers' firewall has to be configured to allow passive connections. – Drav Sloan Sep 15 '13 at 13:49
  • Thank you very much Drav, I learned quite a lot from your post. I will make the answer as correct and diagnose the problem using the knowledge you gave me :) When I have enough rep I will also upvote your answers. – HeWhoBuilds Sep 15 '13 at 19:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.