I have a Nethserver installation, behind a pfSense firewall. The nethserver has only a green network.
I have enabled vsftp from the Web Server application and left everything as default.
I’m able to use ftp from the same subnet, but when I try from the external network, passing through the pfSense the connection fails. I have redirected port 21 and the range from 30000 to 30999 to the Nethserver, using pfSense, but it seems not to be enough.
From the log I have:
Mon Dec 2 22:42:23 2019 [pid 13429] CONNECT: Client “192.168.0.99”
Mon Dec 2 22:42:23 2019 [pid 13428] [xxxxxxxxx] OK LOGIN: Client “192.168.0.99”
and nothing else, the ftp client tries to retrieve the list of files but the request times out.
I have also tried to create a template-custom/etc/vsftp/vsftp.conf/90active file, to configure vsftp in active mode, but it does not seem to work. The vsftp.conf file does not have the additional lines contained in 90active file, and in any way I would prefer the passive mode.
Is there something I need to configure on the firewall ? Or any other information I need to add to the vsftp.conf ?
[root@mars ~]# expand-template /etc/vsftp/vsftp.conf
ERROR: Cannot create output file //etc/vsftp/vsftp.conf.21549 No such file or directory
at /sbin/e-smith/expand-template line 45.
But, I’m wondering why the passive mode is not working, I have forwarded all the ports to the Nethserver, so there should be something blocking the connection from other networks.
You are right, I forgot a s. But the folder is correct, the additional template is in /etc/e-smith/tempates-custom/etc/vsftp/vsftp.conf/ and it called 90active.
The reason I asked is because when in active mode, I see a response back from the server to client that uses high ports, but not the ones defined for passive transfer. Here’s what a netstat shows, on my server, seconds after a client requested data, hence the TIME_WAIT as the port was closed following the transfer:
Hi, this is exactly what I see on my system, when I connect from inside the same network. When I connect from outside the second line is not in the TIME_WAIT status, since the client cannot connect, it stays in listen.
But now, I understood what is happening, when the first connection is established, the server returns to the client the ipaddress and the port for the data transfer connection, and the IP address is the private one 192.168.10.95, instead of the public one (the one of the pfSense that will redirect the connection).
There shoud be a configuration in vsftp.conf with the IP address or the FQDN to be returned to manage the case where the FTP server is behind a proxy (or at list, there is such configuration in proftp server).
The NAT forwarding on pfSense was working, but the one on Nethserver was blocking the ports used by vsftpd passive mode.
Now, I have installed the firewall app on Nethserver and created two rules to open the ports. My problem now, is that I should open the ports for any ip address, but the interface only allows me to put an host or a CIDR in the source field. I tried with “all” but it did not work.
