Issue with NAT and Passive FTP

Question

Hi all,

I have to create a rule that permits to reach an internal FTP server from the WAN. I read all the topics I could find here on the Community, but couldn't make it work.

Here's the situation.

The internal FTP server is a CentOS7 server that runs VSFTPD. This is the configuration:

anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
xferlog_std_format=YES
ascii_upload_enable=YES
ascii_download_enable=YES
listen=YES
listen_ipv6=NO
dual_log_enable=YES
log_ftp_protocol=YES
pam_service_name=vsftpd
userlist_enable=YES
tcp_wrappers=NO
use_localtime=YES

pasv_address=<my_public_address>
pasv_enable=YES
pasv_min_port=50000
pasv_max_port=50010

listen_port=9021

As you can see, the non-standard port 9021 is used. Also, I assigned ports 50000-50010 for passive FTP connections.

I created the following rule at the top, called "SFTPE9021" (see screenshots below):

Finally, on XG console, I set:

set service-param FTP add port 9021

set advanced-firewall ftpbounce-prevention data

When I try to connect via FTP from a client, I receive the following messages (FileZilla):

Status: Connecting to <my_public_address>:9021...
Status: Connection established, waiting for welcome message...
Response: 220 (vsFTPd 3.0.2)
Command: USER <my_user>
Response: 331 Please specify the password.
Command: PASS **********
Response: 230 Login successful.
Command: OPTS UTF8 ON
Response: 200 Always in UTF8 mode.
Status: Logged in
Status: Retrieving directory listing...
Command: PWD
Response: 257 "/home/<my_user>"
Command: TYPE I
Response: 200 Switching to Binary mode.
Command: PASV
Response: 227 Entering Passive Mode (xx,xx,xx,xx,195,82). #I removed the IP

Command: LIST
Error: The data connection could not be established: ECONNREFUSED - Connection refused by server
Error: Connection timed out after 20 seconds of inactivity

With TCPDUMP on the FTP server I can see traffic on port 9021, but none on the 50000-50010.

Also, on XG logs, I see traffic only towards my WAN address (Port2), but none on the FTP server's addresses (public or private). Nothing useful neither on Linux logs on the FTP server.

I think that XG is the problem because setting a local address in the pasv_address parameter in the VSFTPD configuration file, the Passive FTP works fine from inside the LAN.

Do you have any ideas?

Thank you very much!

P.S.

I know that plain FTP is non-secure and other protocols should be used, but it is a request for very old legacy machines... you know the story :)

EDIT: I forgot: I use XG v17.5.0 GA.

This thread was automatically locked due to age.

scaglio · Accepted Answer

Hi all, The root cause if the issue was... the ISP, which had the passive high ports closed. 
 Now they've been opened and XG rule is the same (number 11) I posted a few days ago, with one service and several ports (connection + data). Works fine! 
 Thank you for yor suggestions!

LuCar Toni · Answer

The Mapped Port is always empty, if you uses multiple Ports / services in one DNAT Rule. This is normal. 
 
 I am pretty sure, the Invalid Traffic - "Could not associate..." Traffic is just dropped traffic, so no Root Cause of your issue. 
 
 First of all, i am not quite sure, if the DNAT Rule supports passive FTP... XG handles FTP via Proxy. So in normal firewall policies, you can check "Scan FTP for malware". But you cannot do it in DNAT rules. I am not sure, if this will work at all. 
 You should perform some kind of tcpdump and check, what is going on. 
 community.sophos.com/.../how-to-tcpdump-on-xg 
 Or you should think about an alternative via VPN + FTP Proxy :)

Argo · Answer

Hi scaglio, 
 have you looked at this post? 
 https://community.sophos.com/products/xg-firewall/f/firewall-and-policies/97757/ftp-passive-mode 
 does this help?