1

I have an OpenSuSE box running vsftp. It is behind a firewall at our hosting company. They control the firewall, I have no access to it. It has unrestricted access from our VPN via 10.x.x.x, and ports 20, 21, 40000-40500 on public IP address 41.x.x.x are forwarded to it.

From our VPN, everything works fine. However, from outside, I'm having issues. When the client switches to Passive mode, the server responds with

227 Entering Passive Mode (10,x,x,x,,157,213)

In Filezilla, I get the message:

227 Entering Passive Mode (41,x,x,x,228,63)

I've worked the ports out to be 40248 and 58203, respectively. In my vsftpd.conf file, I have the lines:

pasv_max_port=40500

pasv_min_port=40000

# pasv_address=10.x.x.x

Which corresponds with the ports that I'm forwarding.

After switching to Passive mode, the client get no further response from the server. I suspect it's because it's trying to connect to an IP address that it can't access, on a port which is not forwarded to the server, and the server is not listening for a connection on that port.

I've tried changing

pasv_address=41.x.x.x

in the config file, but all that it achieves is breaking the connection from the VPN. As soon as the connection originates on 41.x.x.x, the ports do not match.

What do I need to change in my config to make this work?

1 Answer 1

3

Based on the IP also being different between the server and client logs, I would suspect that the firewall is intercepting the connection and attempting to NAT it or something (although it should still work if the firewall is doing this correctly). Can you try connecting with SSL/TLS so that the firewall doesn't mess with the control connection?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .