FTP Timeout

Equin · 10-02-2005, 09:40 PM

Hey everybody,

I recently got an SDSL connection from G4 Communications for my servers here at home. Everything seems to be working great except for FTP.

I am running VSFTPD on a FC3 based box. I can connect to it just fine from anywhere in the local network. When somebody on the outside tries to connect, it doesn't work. They seem to be able to authenticate just fine, but when the directory listing comes it just times out.

I logged into one of the UNIX servers over at work and logged into my server here at home, it timed out as expected - I then turned off passive mode and the directory listing came without any problem.

I am using 1:1 NAT on my gatway (m0n0wall) - 216.177.19.108, port 20 and 21 TCP (Among the other usuals) are being forwared to 10.0.1.1

In the config for VSFTPD I tried "pasv_enable=NO" - That just gave me permission denied, though, when I tried to list the directory.

I should also note that it is possible to connect to the FTP server when I (Or anybody else) is connected to the m0n0wall's PPTP VPN service

At this point I am sort of stuck - Any help or suggestions would be greatly appreciated

Thanks a bunch!
-Equin

sal_paradise42 · 10-02-2005, 11:07 PM

I belive you need the ftp connection tracking module

Quote:

CONFIG_IP_NF_FTP - This module is required if you want to do connection tracking on FTP connections. Since FTP connections are quite hard to do connection tracking on in normal cases, conntrack needs a so called helper; this option compiles the helper. If you do not add this module you won't be able to FTP through a firewall or gateway properly

run this command

Code:

/sbin/modprobe ip_conntrack_ftp

Equin · 10-02-2005, 11:52 PM

I just run that command once in the command line? Or is this an option for VSFTPD ?

Thanks
-Eq

sal_paradise42 · 10-02-2005, 11:55 PM

is actually a kernel module, is part of iptables which is the m0n0wall's underlying program.
Yeah just give it a run on the command line and see if it makes a diff. if it doesn't find it, you may need to download it.

Equin · 10-03-2005, 09:32 AM

Okey - So I am running this command on the m0n0wall?

If so - where do I execute it? I don't think there's any command line on m0n0wall - is there?

-Equin

Equin · 10-05-2005, 03:33 PM

Still haven't got it to work. Here's the error I get in a command line on my Mac. (OS X 10.4 Tiger)

ftp> open
(to) equis.seanspc.net
Connected to equis.seanspc.net.
220 Equis.seanspc.net - FTP Service. Please play nice
Name (equis.seanspc.net:sean): root
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
200 PORT command successful. Consider using PASV.
^C
421 Service not available, user interrupt. Connection closed.

Here's the configuration on my server (Part of it, at least):

pasv_enable=YES
pam_service_name=vsftpd
userlist_enable=YES
#enable for standalone mode
listen=YES
tcp_wrappers=YES

Anybody got any ideas?

Thanks a bunch!!!
-Equin