12

I get the error "Server sent passive reply with unroutable address. Using server address instead." when connecting to a FTP site (not SFTP).

I have connected to this site many times, however FileZilla asked me to accept a certificate on this occasion for the first time.

It does not appear to be an issue with the account I am connecting with as it happens on all accounts on that server.

enter image description here

Improve this question

4 Answers 4

Reset to default
5

This is old question but thought it may help other. I have a similar issue and mentioned by @HBrujin I have correct pasv_address specified as well but still having similar message appearing on Filezilla.

First of all find out what IP address you are getting as PASV command by enabling debug mode in FileZilla and you may see line like below

Response:   227 Entering Passive Mode (0,0,0,0,4,7).

I was hoping my public address instead of 0.0.0.0 as I have already specified pasv_address. Later on realized that it was due to listen_ipv6=YES setting and pasv_address has IP4. Just add change configuration to 

#listen_ipv6=YES
listen=YES

resolved my issue.

Improve this answer
2
3

When the client is initiating a data transfer, it asks the FTP server, where to connect to. The IP address that you server provides is likely its internal address on its network, rather than an external IP address that can be used by the client. It's an incorrect configuration on the server-side.

But as this is a quite common misconfiguration, many FTP clients, including FileZilla, can workaround it. They simply ignore any IP address the server provides, if it's unroutable from the client's network location, and use an FTP server address instead. That's what happened.

See my recent answer for explanation of the passive mode architecture.

Regarding the certificate accepting: As you did not share with us, what was the reason given by FileZilla to ask you to accept the certificate, we cannot really help you.

Improve this answer
2

Looks at first glance as a NAT issue with the FTP protocol helper failing because of the TLS encryption and I would expect that to become a firewall problem as well.

Some background here in an older answer of mine.

The solution is probably to fix the passive TCP port range that FTP over SSL can use, have the FTP server advertise the external IP-address rather than the actual ip-address (the pasv_address directive in VSFTPD) and to create static NAT rules for those ports.

Improve this answer
4
  • 2
    Thanks for your comment. Is this a change I need to make to the firewall on the actual FTP server or within the settings in my FTP client? I have checked with a colleague and he has been able to connect to the server without any problems.
    – crmpicco
    Jan 9, 2015 at 15:24
  • The first would to confirm that your colleague is actually using TLS encryption, as that is far from the default. Second it is not primarily a firewall issue but appears an issue that can occur when the FTP server is behind a NAT device. I don't know your network topology and am making an educated guess only. No NAT and your problem may both have a vastly different cause and a completely different solution.
    – HBruijn
    Jan 9, 2015 at 15:30
  • I'm looking through the FileZilla settings to see if I can turn TLS encryption off - can't see anything. I don't get a message regarding TLS on any other server I connect to?
    – crmpicco
    Jan 9, 2015 at 15:38
  • You could also use a client which supports CCC with TLS (from a short google FileZilla does not). In this case only the login is protected by TLS and the PORT/PASV handshake is still in clear so that the firewall helper could inspect or rewrite it and open the necessary ports.
    – Steffen Ullrich
    Jan 9, 2015 at 15:54
0
  1. If you use vsftpd, set
    pasv_min_port=21000
    pasv_max_port=21999

in vsftpd.conf file.

  1. Open that port range in your network console panel of your VPS/Cloud provider.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .