FTP Server Behind Router

[backscratcher]

I have set up Fedora Core 4 as a server (httpd, mysql and ftp). This server is behind a router. I have set port redirection on this router for ports 80, 20 and 21 to the server's local IP Address (192.168.1.100). I have subscribed to dyndns.com to resolve my dynamic ip to a fix named url. That works just fine.

I don't have problems accessing the web pages on the server locally and from the internet.

My problem is on FTP. I can do ftp from another machine in my local network by typing $ftp 192.168.1.100. However, I cannot do the same thing from the internet by typing $ftp <dyndns fix named url>:21.

[till]

Thats a common problem with FTP behind NAT as FTP tries to initiate a second connection on higher ports after initial connect. Have you tried both, passive and active FTP mode?

[ak007]

Guys Im having Same Problem 2 ive got two server behind router the first one is on standar port 21 and the second one is on non-standard por which is 7511 on second one when i connect i get errors when it enters PASV MODE ive also tried PORT but no hope any soloutions?
im using debian 3.1 sarge and pureftpd

Thanks,
Ak007

[falko]

Have you tried active mode?

[themachine]

You are behind a firewall which means tht you need to enable Passive FTP properly.

PROFTPD:

Edit /etc/proftpd.conf or whatever your conf file is:

PassivePorts 40000 40100


VSFTPD:

Edit /etc/vsftpd.conf or whatever your conf file is:

pasv_enable=YES
pasv_promiscuous=YES
pasv_min_port=40000
pasv_max_port=40100
pasv_address=192.168.1.100


Note that you are opening up ports 40000 -> 40100 for Passive connections... therefore you need to also open up these ports on your firewall. You will then have no problems (but you will need to enable passive ftp in your ftp cient.


Does that work?

[ak007]

Yes That Worked For Proftpd But I need To Know How To I Add users In Vsftpd And How Do I Change The Port In Pureftpd?

[till]

FTP users in vsftpd are in most cases sytem users. Add a system user and try to login with that user.

If pureftpd reads its configuration from a mySQL database, you will have to add the users accounts there.

You may have a look at this howto too:
http://www.howtoforge.com/pureftpd_m...irtual_hosting

[ak007]

ive changed vsftpd Configuration But Its Not Working when i conenct to the server It Gives Me :

Status: Connecting to 83.83.83.188:7511 ...
Status: Connected with 83.83.83.188:7511. Waiting for welcome message...
Response: 220 (vsFTPd 2.0.4)
Command: USER anonymous
Response: 331 Please specify the password.
Command: PASS *****
Response: 230 Login successful.
Command: FEAT
Response: 211-Features:
Response: EPRT
Response: EPSV
Response: MDTM
Response: PASV
Response: REST STREAM
Response: SIZE
Response: TVFS
Response: 211 End
Command: SYST
Response: 215 UNIX Type: L8
Status: Connected
Status: Retrieving directory listing...
Command: PWD
Response: 257 "/"
Command: TYPE A
Response: 200 Switching to ASCII mode.
Command: PASV
Response: 227 Entering Passive Mode (192,168,2,79,49,160)
Command: LIST
Error: Transfer channel can't be opened. Reason: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.
Error: Could not retrieve directory listing

ive alos opened ports for pasv Mode in my router But Not Working
Here is my vsftpd.conf file

# Example config file /etc/vsftpd.conf
#
# The default compiled in settings are fairly paranoid. This sample file
# loosens things up a bit, to make the ftp daemon more usable.
# Please see vsftpd.conf.5 for all compiled in defaults.
#
# READ THIS: This example file is NOT an exhaustive list of vsftpd options.
# Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's
# capabilities
listen=YES
listen_port=7511
# Allow anonymous FTP? (Beware - allowed by default if you comment this out).
anonymous_enable=YES
#
# Uncomment this to allow local users to log in.
#local_enable=YES
#
# Uncomment this to enable any form of FTP write command.
#write_enable=YES
#
# Default umask for local users is 077. You may wish to change this to 022,
# if your users expect that (022 is used by most other ftpd's)
#local_umask=022
#
# Uncomment this to allow the anonymous FTP user to upload files. This only
# has an effect if the above global write enable is activated. Also, you will
# obviously need to create a directory writable by the FTP user.
#anon_upload_enable=YES
#
# Uncomment this if you want the anonymous FTP user to be able to create
# new directories.
#anon_mkdir_write_enable=YES
#
# Activate directory messages - messages given to remote users when they
# go into a certain directory.
dirmessage_enable=YES
#
# Activate logging of uploads/downloads.
xferlog_enable=YES
#
# Make sure PORT transfer connections originate from port 20 (ftp-data).
connect_from_port_20=YES
#
# If you want, you can arrange for uploaded anonymous files to be owned by
# a different user. Note! Using "root" for uploaded files is not
# recommended!
#chown_uploads=YES
#chown_username=whoever
#
# You may override where the log file goes if you like. The default is shown
# below.
#xferlog_file=/var/log/vsftpd.log
#
# If you want, you can have your log file in standard ftpd xferlog format
#xferlog_std_format=YES
#
# You may change the default value for timing out an idle session.
#idle_session_timeout=600
#
# You may change the default value for timing out a data connection.
#data_connection_timeout=120
#
# It is recommended that you define on your system a unique user which the
# ftp server can use as a totally isolated and unprivileged user.
#nopriv_user=ftpsecure
#
# Enable this and the server will recognise asynchronous ABOR requests. Not
# recommended for security (the code is non-trivial). Not enabling it,
# however, may confuse older FTP clients.
#async_abor_enable=YES
#
# By default the server will pretend to allow ASCII mode but in fact ignore
# the request. Turn on the below options to have the server actually do ASCII
# mangling on files when in ASCII mode.
# Beware that on some FTP servers, ASCII support allows a denial of service
# attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd
# predicted this attack and has always been safe, reporting the size of the
# raw file.
# ASCII mangling is a horrible feature of the protocol.
#ascii_upload_enable=YES
#ascii_download_enable=YES
#
# You may fully customise the login banner string:
#ftpd_banner=Welcome to blah FTP service.
#
# You may specify a file of disallowed anonymous e-mail addresses. Apparently
# useful for combatting certain DoS attacks.
#deny_email_enable=YES
# (default follows)
#banned_email_file=/etc/vsftpd.banned_emails
#
# You may specify an explicit list of local users to chroot() to their home
# directory. If chroot_local_user is YES, then this list becomes a list of
# users to NOT chroot().
#chroot_list_enable=YES
# (default follows)
#chroot_list_file=/etc/vsftpd.chroot_list
#
# You may activate the "-R" option to the builtin ls. This is disabled by
# default to avoid remote users being able to cause excessive I/O on large
# sites. However, some broken FTP clients such as "ncftp" and "mirror" assume
# the presence of the "-R" option, so there is a strong case for enabling it.
#ls_recurse_enable=YES
pasv_enable=YES
pasv_promiscuous=YES
pasv_min_port=40000
pasv_max_port=40100
pasv_address=192.168.2.79

after ive added last lines for pasv mode i get following errors wgen i start vsftpd

host:# 500 OOPS: could not bind listening IPv4 socket

[3]+ Exit 1 /usr/local/sbin/vsftpd

[themachine]

Yes.... that is interesting. I am assuming that since you're asking about "vsftpd" and "pureftpd" that you are running both on this machine, yes? Plus you are using an alternate port in your 'listen_port' option. That being said, is it possible that you could try stopping all other ftp servers and try restarting vsftpd again. It might be that the passive_address setting is binding to port 21 and overriding the 'listen_port' option.

just a theory.

[HaydenHarnet]

try active mode , it had solved a similar problem for me in the past with a linksys e2000
__________________
routers compare