i have a question about the proxy design.
Actually my sophos UTM is not the default gateway, but acting as a proxy with a separate DSL Line.
It is running on Port 3128 (changed)
We point with the windowsclient to the proxy 172.16.1.1 Port 3128 that works great for any http/https ...
If we want to use the proxy for unencrypted ftp with filezilla, we got an error message on the proxy log.
The allowed services tab include: FTP, HTTP, HTTP Proxy, HTTPS, LDAP, LDAP SSL, Spam Release, Webadmin (all default). And the network is allowed to use the proxy. FTP Proxy is switched on with the mode "both"
Status: Verbinde mit ftp.***.net über Proxy
Status: Auflösen der IP-Adresse für wicproxy
Status: Verbinde mit 172.16.1.1:3128...
Status: Verbindung mit Proxy hergestellt, führe Handshake durch...
Antwort: Proxy-Antwort: HTTP/1.1 200 Connection established
Status: Verbindung hergestellt, warte auf Willkommensnachricht...
Antwort: 220 ProFTPD 1.3.1 Server (***.net FTP Server) [5.5.5.5]
Befehl: USER testftp1
Antwort: 331 Password required for testftp1
Befehl: PASS *********
Antwort: 230 User testftp1 logged in
Befehl: OPTS UTF8 ON
Antwort: 200 UTF8 set to on
Status: Verbunden
Status: Empfange Verzeichnisinhalt...
Befehl: PWD
Antwort: 257 "/" is the current directory
Befehl: TYPE I
Antwort: 200 Type set to I
Befehl: PASV
Antwort: 227 Entering Passive Mode (5,5,5,5,132,173).
Befehl: LIST
Status: Verbinde mit 172.16.1.1:3128...
Status: Verbindung mit Proxy hergestellt, führe Handshake durch...
Antwort: Proxy-Antwort: HTTP/1.1 403 Target service not allowed
Fehler: Proxy-Handshake fehlgeschlagen: ECONNRESET - Connection reset by peer
the logfile:
2013:09:19-09:51:17 Webgate-1 httpproxy[29933]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="CONNECT" srcip="10.110.121.94" dstip="" user="" statuscode="403" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2360" request="0x1272acd0" url="5.5.5.5:39635/" exceptions="" error="Target service not allowed"
FTP Proxy Log (added a little bit later):
2013:09:19-09:03:49 WebGate-1 frox[29710]: Connection closed -- unable to contact server
2013:09:19-09:03:49 webGate-1 frox[29710]: Closing session
2013:09:19-09:03:54 WebGate-1 frox[29723]: Connect from 10.110.121.94
2013:09:19-09:03:54 WebGate-1 frox[29723]: ... to 172.16.1.1()
2013:09:19-09:03:54 WebGate-1 frox[29723]: Connection refused when trying to connect to 172.16.11.1
2013:09:19-09:03:54 WebGate-1 frox[29723]: Connection closed -- unable to contact server
2013:09:19-09:03:54 WebGate-1 frox[29723]: Closing session
2013:09:19-09:27:12 WebGate-1 frox[890]: Frox started
2013:09:19-09:27:12 WebGate-1 frox[890]: Listening on 0.0.0.0:2121
2013:09:19-09:27:12 WebGate-1 frox[890]: Dropped privileges
What i understand is, that the client tried to switch to passive mode and that is not allowed in the proxy list. But anyway nobody knows the passive ports, bec. they change ...
If i enter in filezilla the generic proxy credentials, it tells me that it will always use passive mode when using a generic proxy.
how you guys solve that problem?
This thread was automatically locked due to age.
