Re: FTP Problem

David M <NOSPAM@xxxxxxxxxx> wrote in
news:06mPg.11975$Qg.2582@xxxxxxxxxxxxxxxx:

On Mon, 18 Sep 2006 00:32:21 +0000, Christopher Smith rearranged some
electrons to form:

Allen Kistler <ackistler@xxxxxxxxx> wrote in news:EWkPg.2374$vJ2.2326
@newssvr12.news.prodigy.com:

Christopher Smith wrote:

Probably some combination of not allowing RELATED connections (in
/etc/sysconfig/iptables) and not loading ip_conntrack_ftp and/or
ip_nat_ftp (in /etc/sysconfig/iptables-config).


Make sure you have the passive mode ports enabled in your firewall.
I did it by limiting the port numbers to between 40000 and 40050, and
allowing those ports to be used on my router.

in /etc/vsftpd/vsftpd.conf

pasv_min_port=40000 (or whatever you like)
pasv_max_port=40050 (or whatever you like)



Did that originally, and have it now.

If I log in remotely to the ftp server (i.e., login from the public side
of the firewall), the pasv connection request to the server responds
correctly.

For example, I told vsftpd to use ports 1200-1203 for testing purposes.
If I'm at work, and I login, the ftp conection goes passive with the
response from the FTP Server as follows:

"Entering passive mode (X,X,X,X,4,177)."

where 4*256 + 177 = 1201, or the first passive port. The firewall is
open and it connects through just fine.

Anything else I can try?

.

Relevant Pages

  • Re: Interesting webserver intrusion (apache 1.3.31, mod_ssl 2.8.18, php 4.3.7)
    ... > fairly tight(only allowing 4 ports in), but perhaps I could tighten it ... The host systems firewall rules govern the access to the jailed system. ... What connections does your server need to ... Perhaps there is a 0-day for your ftp server out there. ...
    (Incidents)
  • Re: Passive Mode issue
    ... in the windows firewall and the network firewall with the same results. ... and the ftp site is bound to a specific public IP. ... The server will timeout from all users trying passive mode. ... passive port range for IIS and opened those ports in the firewall, ...
    (microsoft.public.inetserver.iis.ftp)
  • RE: Cannot set up 3rd-party ftp server on VISTA
    ... so no ports to be set there I suppose. ... And even when turning off the McAfee firewall, ... Have you tried connecting to the FTP server from the LAN side? ...
    (microsoft.public.windows.vista.networking_sharing)
  • Re: FTP Server with Norton Internet Security 2003
    ... >trojan intrusion on my system when i try and connect. ... The FTP server ... Any good firewall will block all ports ... If you want to allow ftp traffic through your firewall then you errm, ...
    (comp.security.firewalls)
  • Re: ProFTP
    ... If your FTP server is behind a firewall/router (and your clients are, ... Your firewall is probably blocking the passive port range ... To help play nicely with firewalls, ProFTPD includes a "PassivePorts" ... ports it will use for PASV transfers. ...
    (freebsd-questions)