This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Ftp dnat 60021

Greetings,
We have a UTM 220 running 8.311.  I've been trying to trace down problems we've been experiencing with various clients who access our FTP server, which is located on the LAN.
In particular are users that connect via PASV mode, pass their credentials then have the connection closed immediately.

The details:

eth0 - LAN, 192.168.0.x/24
eth1 - T1 WAN connection, being phased out, not involved in this situation.
eth2 - Fiber WAN connection. (207.51.171.18/28)

An additional address is configured on eth2 for the public IP of our FTP server.  (207.51.171.20).
Our FTP server's internal IP is 192.168.0.222.  The FTP server has a PASV IP address set to 207.51.171.20, so it responds with that IP instead of internal IP.
Since we are using PASV mode, additional ports (50000-50049)
are defined for the data transfer.  Therefore I have a group for all FTP traffic - port 21 and the PASV mode ports.

The DNAT is simple - Any 'FTP OR PASV' going to the Public interface to be sent to the internal ip address of the FTP server.  Automatic rules creation.

This works for most users, however a handful drop automatically after login.

Viewing the FW log I see the following:

2014:02:18-10:16:43 gateway-1 ulogd[5798]: id="2000" severity="info" sys="SecureNet" sub="packetfilter" name="Packet logged" action="log" fwrule="60021" initf="eth2" srcmac="0:17:94:61:9:a9" dstmac="0:1a:8c:f0:24:a2" srcip="128.143.219.216" dstip="207.51.171.20" proto="6" length="64" tos="0x00" prec="0x00" ttl="49" srcport="54153" dstport="21" tcpflags="SYN"

The srcip is the client having the problem, dest ip is the public ip for my FTP server.

Based on the posts I've read I know I have a NAT problem, but I need some more information to understand.
On one post I see that fwrule="60021" means that your DNAT was still active, and that that's what was/is causing the failure to reach the server on the "External (Address)".

- what does that mean that the DNAT is still active?  How does one resolve that?
Other posts suggest creating a Full NAT rule; but the thread ends without listing if it was a success.

Please advise on how best to configure our file server access.
Regards,

This thread was automatically locked due to age.

0 BAlfson over 11 years ago

That line just confirms that a NAT connection was made. Please [Go Advanced] below and attach a picture of the DNAT WITH "Advanced' open. Also, confirm for us that your FTP server has the internal IP of the UTM as its default gateway.

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel
0 JonEtkins over 11 years ago

Do you have the FTP connection tracking helper enabled under Network Protection--> Firewall --> Advanced ?
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 11 years ago

Will the conntrack helper work on alternate ports?

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 JonEtkins over 11 years ago

I have it enabled, and a static FTP set up that sounds identical, and mine has never given a moment's trouble.

(Edit: Identical except mine is not NAT'ed from an alternative address on the WAN - I only have one WAN address)
Cancel
Vote Up 0 Vote Down

Cancel
0 dclab over 11 years ago

As requested attached are the nat rules used.

For my DNAT rules I split into two rules - one for standard FTP port 21 and a second for the PASV ports. I have a SNAT rule that I've tested (included in the attached image) as the firewall logs would occasionally show the internal ip address of the FTP server responding during the FTP transmissions.

I do have the FTP conntrack helper turned on.

Thanks for your help!
- ftpnat.png
- View
- Hide
Cancel
Vote Up 0 Vote Down

Cancel
0 dclab over 11 years ago

Quick mention - I also have an exception for Intrusion Detection scanning on traffic to the server (internal address) as well as the public address.
Cancel
Vote Up 0 Vote Down

Cancel
0 JonEtkins over 11 years ago

I don't see any reason why that should not work, but for comparison, I have a single DNAT rule which uses a Service Group that I created to bundle FTP, FTPS, and my static ports together, and I have no SNAT.
Cancel
Vote Up 0 Vote Down

Cancel
0 dclab over 11 years ago

Yes, that's the way we normally had our FTP rules. I split mine up just for experimentation, just like the SNAT. Does your FTP server have a setting in PASV mode to respond with the external ip address?
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 11 years ago

Just for grins, please check all of the logs mentioned in #1 in https://community.sophos.com/products/unified-threat-management/astaroorg/f/51/t/22065 (also, confirm that none of #3 or #3.1 are violated). If that doesn't give us a clue, I think the issue will be with the configuration of the FTP server.

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel
0 JonEtkins over 11 years ago in reply to dclab

Does your FTP server have a setting in PASV mode to respond with the external ip address?
Yes. It must for PASV to work with non-local clients.
Cancel
Vote Up 0 Vote Down

Cancel