pure-ftpd configuration behind load-balancer

Discussion in 'Installation/Configuration' started by nhybgtvfr, Apr 9, 2015.

  1. nhybgtvfr

    nhybgtvfr Member

    Hi,
    I'm trying to get the pure-ftpd working on an ispconfig3 server (latest version on Ubuntu 14.04), the server is behind a load-balancer (haproxy 1.5).
    being behind the load-balancer, I need to configure it for passive mode, and masquerade a public ip.
    I have another server behind this load balancer, running proftpd. which is working fine.
    I have the following iptables rules on the load-balancer:
    -A PREROUTING -d 213.146.180.246/32 -p tcp -m tcp --dport 6100:6200 -j DNAT --to-destination 192.168.51.201
    -A PREROUTING -d 149.5.110.203/32 -p tcp -m tcp --dport 6100:6200 -j DNAT --to-destination 192.168.51.153
    -A POSTROUTING -s 192.168.51.201/32 -j SNAT --to-source 213.146.180.246
    -A POSTROUTING -s 192.168.51.153/32 -j SNAT --to-source 149.5.110.203

    the haproxy is configured with:
    listen ubuntu12-ftp
    bind 213.146.180.246:21
    mode tcp
    bind-process 1
    option tcplog
    balance leastconn
    server ubuntu12 192.168.51.201:21 check

    listen hyh-ftp
    bind 149.5.110.203:21 #transparent
    mode tcp
    bind-process 1
    log global
    option tcplog
    server hyh 192.168.51.153:21 #send-proxy

    on the server with proftpd, I had to edit the configuration to get it to work, these are the relevant settings
    DefaultAddress 192.168.51.201
    PassivePorts 6100 6200
    MasqueradeAddress 213.146.180.246
    AllowForeignAddress on

    for pure-ftpd, I've created the following files in etc/pure-ftpd/conf.d
    ForcePassiveIP contents: 149.5.110.203
    PassivePortRange contents: 6100 6200

    when I try to ftp to this server I get:

    Status: Connecting to 149.5.110.203:21...
    Status: Connection established, waiting for welcome message...
    Status: Connected
    Status: Retrieving directory listing...
    Command: PWD
    Response: 257 "/" is your current location
    Command: TYPE I
    Response: 200 TYPE is now 8-bit binary
    Command: PASV
    Response: 500 Unknown command
    Command: PORT 192,168,0,28,48,49
    Response: 500 I won't open a connection to 84.45.154.103 (only to 192.168.51.2)
    Error: Failed to retrieve directory listing

    85.45.154.103 is the adsl router ip from my end. 192.168.51.2 is the physical nic's ip on the internal interface of the load balancer.
    the load balancer is 1 of a pair, with a floating ip of 192.168.51.1 on the internal side, this floating ip is the ftp servers default gateway.


    what else do I need to do to get pure-ftpd working? I've tried using transparent, or send-proxy in the haproxy configuration, neither helped.

    thanks
    lee.
     

Share This Page