This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Cannot access anymore to external ftp sites

hello
since 8.302 upgrade, I cannot access anymore to external FTP sites using our internal interface. This interface is proxied for http/ftp traffic. The client simply tries to reach FTP sites for a long time, then the browser returns an error (it is not an astaro error). If I try to remove FTP service from Allowed Target Services, I obviously get and Astaro error (target service not allowed). So the proxy is configured correctly.

Anyway I noticed these entries in packetfilter log (where 129.35.224.115 is the ip of external ftp site):

2012:06:07-10:25:32 mywirewallname ulogd[5666]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60001" initf="eth3" srcmac="00:00:00:00:00:00" dstmac="11:11:11:11:11:11" srcip="129.35.224.115" dstip="MY PUBLIC WAN INTERFACE IP ADDRESS" proto="6" length="85" tos="0x00" prec="0x40" ttl="48" srcport="21" dstport="40222" tcpflags="ACK PSH"
2012:06:07-10:25:32 mywirewallname ulogd[5666]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60001" initf="eth3" srcmac="00:00:00:00:00:00" dstmac="11:11:11:11:11:11" srcip="129.35.224.115" dstip="MY PUBLIC WAN INTERFACE IP ADDRESS" proto="6" length="89" tos="0x00" prec="0x40" ttl="48" srcport="21" dstport="40222" tcpflags="ACK PSH FIN"

any idea?

This thread was automatically locked due to age.

Parents

0 BAlfson over 13 years ago

Are the ConnTrack helpers on the 'Advanced' tab of 'Firewall' still selected?

If they are, then my guess is that you'll need to change some TCP timeout at the command line, but I don't know which one. Maybe you can deduce that from the time it takes for those to show up and from the list and instructions from da_merlin: https://community.sophos.com/products/unified-threat-management/astaroorg/f/54/t/40331.

Let us know the solution!

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 BAlfson over 13 years ago

Are the ConnTrack helpers on the 'Advanced' tab of 'Firewall' still selected?

If they are, then my guess is that you'll need to change some TCP timeout at the command line, but I don't know which one. Maybe you can deduce that from the time it takes for those to show up and from the list and instructions from da_merlin: https://community.sophos.com/products/unified-threat-management/astaroorg/f/54/t/40331.

Let us know the solution!

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 eclipse79oldacct over 13 years ago in reply to BAlfson

Are the ConnTrack helpers on the 'Advanced' tab of 'Firewall' still selected?

If I remember correclty, yes, all except tftp (tomorrow morning I will check). Anyway I noticed that with proxy in transparent mode I have no issue (our guest network can reach ftp servers). The issue occurs only with the proxy in standard mode :-/. I will make some test and post the results

thanks
eclipse79
Cancel
Vote Up 0 Vote Down

Cancel

0 eclipse79oldacct over 13 years ago in reply to eclipse79oldacct

Bob,
it was a Multipath rule issue.

Look at this:

1	DNS su prima linea [by Interface]	[persistence by combination of SRC and DST IP address]
	DMZ (Network) 	→		DNS 	→		ISP_1 DNS Servers →		External (WAN) 
	2	Web su prima linea DMZ [by Interface]	[persistence by combination of SRC and DST IP address]
	DMZ (Network) 	→		Web Surfing 	→		Internet →		External (WAN) 
	3	Mail su prima linea [by Interface]	[persistence by combination of SRC and DST IP address]
	Any 	→		Email Messaging 	→		Internet →		External (WAN) 
	4	DNS Hostmonitor su prima linea [by Interface]	[persistence by combination of SRC and DST IP address]
	Hostmonitor 	→		DNS 	→		ISP_1 DNS Servers →		External (WAN) 
	5	DNS su seconda linea [by Interface]	[persistence by combination of SRC and DST IP address]
	Any 	→		DNS 	→		ISP_2 DNS Servers 	→		External ISP_2 (WAN) 
	6	Streaming su seconda linea [by Interface]	[persistence by combination of SRC and DST IP address]
	Any 	→		Media Streaming 	→		Internet 	→		External ISP_2 (WAN) 
	7	Web su seconda linea [by Interface]	[persistence by combination of SRC and DST IP address]
	Any 	→		Web Surfing 	→		Internet 	→		External ISP_2 (WAN)

The 7th rule contains web surfing (so also FTP). The first interface listed in Uplink Balancing was External (WAN) (that belongs to ISP_1), the second was External ISP_2 (WAN). So inverting them (so that the default interface is External ISP_2) or replacing Web surfing with Any at rule 7 solved my issue. In other words there was a difference between the interface used for port 21 and interface used for ports > 1023 (used in ftp protocol too!)

bye
eclipse79