Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 5 replies
  • Subscribers 27 subscribers
  • Views 4376 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Accessing Clients FTP Site From Local Subnet

SophosNewby

I'm a bit unsure how to go about creating this firewall rule. In order for staff to grab files from a clients FTP site, their FTP server needs to recognize us. ON the previous Juniper firewall these were the following entries.

 

I have the clients IP address, destination-port = 1025-1055, protocol ftp, I have setup it up like this but can't seem to establish the FTP connection through Filezilla. 

FlexFTP is Host object setup with the clients IP. Not sure how to set this outside FTP access up.

 



This thread was automatically locked due to age.
Parents
  • 0

    Hi,

    that rule wil allow the external site access to your LAN.

    I think you are wanting your internal users to access the ftp site? Unless there is a specific reason to add the ftp server that is different to general internet access, then you will not need an ftp rule.

    Ian

  • 0 in reply to rfcat_vk

    Honestly I was just trying to interpret the Juniper configuration from the previous firewall. You are 100% correct we are accessing the clients FTP site and I have had zero luck trying to get LAN to WAN to work at all on this device so I was trying anything. Even on the initial setup on SAturday I had all my LAN to WAN and WAN to LAN rules completely separate for traffic going in and out and I ended up deleting all my User/Network rules and simply checked Reflexive rule in the business rules to get everything to work.

     

    I tried reversing everything first and the same result, no authentication. Baffled why I'm struggling with these rules.

  • 0 in reply to SophosNewby

    Hi,

    a simple rule to get you going.

    Source any, network any, destination any, network any, services any, nat, masq, use primary gateway.

    You can added IPS lan to wan, web policy allow all, application policy allow all.

    From there you can refine with additional rules.

    Remember the rules are applied top down, not by id number.

    Ian

  • 0 in reply to rfcat_vk

    Thanks, yeah I'm having no luck, is there a way to see a detailed view of the log from previous attempts in Sophos to see where its possibly going wrong. 

    ON Filezilla end I will get:

    Status: Connection established, waiting for welcome message...
    Response: 220 FTP Server ready.
    Command: AUTH TLS
    Response: 234 AUTH TLS successful
    Status: Initializing TLS...
    Error: Connection timed out after 20 seconds of inactivity
    Error: Could not connect to server

     

    ON my firewall, this is the only log I can seem to find as I'm not too familiar with the details of logs.

    Firewall
    2017-11-30 08:17:52
    Invalid Traffic
    Denied
    		  
    0
    Port1
    		  
    192.168.0.150
    x.x.x.x
    0
    01001
    Open PCAP
    Could not associate packet to any connection

     

    The x.x.x.x is just me manually masking their IP address but I'm thinking the log should say my WANs IP and not my PC. 

    And this log entry:

    Firewall
    2017-11-30 08:16:01
    Firewall Rule
    Allowed
    		  
    2
    Port1
    		  
    192.168.0.150
    x.x.x.x
    1
    00001
    Open PCAP
    		  
     

     

     

    So I am bit confused firstly Rule 0, I"m confused what this is and about firewall Rule 2 is my default LAN -> WAN not the Rule I created for this, outgoing traffic, which happens to be Rule 5. Rule 5 is located above the default Lan->WAN rule.

Reply
  • 0 in reply to rfcat_vk

    Thanks, yeah I'm having no luck, is there a way to see a detailed view of the log from previous attempts in Sophos to see where its possibly going wrong. 

    ON Filezilla end I will get:

    Status: Connection established, waiting for welcome message...
    Response: 220 FTP Server ready.
    Command: AUTH TLS
    Response: 234 AUTH TLS successful
    Status: Initializing TLS...
    Error: Connection timed out after 20 seconds of inactivity
    Error: Could not connect to server

     

    ON my firewall, this is the only log I can seem to find as I'm not too familiar with the details of logs.

    Firewall
    2017-11-30 08:17:52
    Invalid Traffic
    Denied
    		  
    0
    Port1
    		  
    192.168.0.150
    x.x.x.x
    0
    01001
    Open PCAP
    Could not associate packet to any connection

     

    The x.x.x.x is just me manually masking their IP address but I'm thinking the log should say my WANs IP and not my PC. 

    And this log entry:

    Firewall
    2017-11-30 08:16:01
    Firewall Rule
    Allowed
    		  
    2
    Port1
    		  
    192.168.0.150
    x.x.x.x
    1
    00001
    Open PCAP
    		  
     

     

     

    So I am bit confused firstly Rule 0, I"m confused what this is and about firewall Rule 2 is my default LAN -> WAN not the Rule I created for this, outgoing traffic, which happens to be Rule 5. Rule 5 is located above the default Lan->WAN rule.

Children