LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 03-03-2005, 03:00 PM   #1
dx0r515t
Member
 
Registered: Jan 2005
Location: USA
Distribution: Slackware 10.2 & 11.0
Posts: 155

Rep: Reputation: 30
how to setup vsftpd to be accessible outside my lan?


Ok, I have vsftpd setup correctly and everything on slack 10.0, and other PC's on my lan can connect to my ftp server with 192.168.2.4 just fine no issues. But obviously this IP won't work outside my lan, how do I assign a address to be accessible on the internet?
 
Old 03-03-2005, 03:06 PM   #2
satinet
Senior Member
 
Registered: Feb 2004
Location: England
Distribution: Slackware 14.1
Posts: 1,469

Rep: Reputation: 46
Presuming you are running a firewall, you need to set up port forwarding.

i.e getting your firewall/router to forward TCP/IP traffic intended for the port the service is running on (21 - FTP in this case) to the relevant machine inside your LAN.

This is generally easy, but it depends on your router/firewall.

Mine has a gui where ports, VPN's and so on can be activated.


Anyway, how do you connect to the internet?

I trust you are aware of the security implication of doing this....
 
Old 03-03-2005, 03:43 PM   #3
dx0r515t
Member
 
Registered: Jan 2005
Location: USA
Distribution: Slackware 10.2 & 11.0
Posts: 155

Original Poster
Rep: Reputation: 30
I connect to the internet through a cable connection using a router.
 
Old 03-03-2005, 06:18 PM   #4
zymurgist
Member
 
Registered: Jan 2003
Location: Long Island
Distribution: Redhat 8.0
Posts: 109

Rep: Reputation: 15
Are you using IPCHAINS, or IPTABLES firewall?
 
Old 03-03-2005, 08:39 PM   #5
dx0r515t
Member
 
Registered: Jan 2005
Location: USA
Distribution: Slackware 10.2 & 11.0
Posts: 155

Original Poster
Rep: Reputation: 30
Quote:
Originally posted by zymurgist
Are you using IPCHAINS, or IPTABLES firewall?
I don't know how do I tell?
but to open my ftp server all I have to do is set the inbound port to 21, my private IP address (192.168.2.4) and the private port (21)? Do i make the connection type TCP or UDP? Do I have to place my ftp server in the DMZ?

ok I got the inbound port set to 21, type set to tcp and private port set to 21. which is right, and my private IP address set to 192.168.2.4. Do I need to place the ftp server computer in the DMZ? I ask this becasue when I type in my IP address in a ftp client it still won't connect..... the client says "Error: Could not read from socket: Connection reset by peer"

ok just tried it with my ftp pc in the dmz and it still won't connect from my internet IP address.

Last edited by dx0r515t; 03-03-2005 at 09:03 PM.
 
Old 03-07-2005, 01:25 PM   #6
zymurgist
Member
 
Registered: Jan 2003
Location: Long Island
Distribution: Redhat 8.0
Posts: 109

Rep: Reputation: 15
It is always recommended to put any publicly accessible servers on the DMZ, but if you secure your ftp server well enough, you don't have to put it on the DMZ. You will need to port forward 21 from your firewall to your ftp server. There are different ways to do this depending on if you're running ipchains or iptables. How did you configure your firewall if you don't know which one you're running?

ken
 
Old 03-07-2005, 07:56 PM   #7
dx0r515t
Member
 
Registered: Jan 2005
Location: USA
Distribution: Slackware 10.2 & 11.0
Posts: 155

Original Poster
Rep: Reputation: 30
This is probably a stupid question, but do I have to have IPCHAINS or IPTABLES for port forwarding to work?
Also which one should I use? Whats the benefit from each one?
 
Old 03-07-2005, 09:21 PM   #8
Hangdog42
LQ Veteran
 
Registered: Feb 2003
Location: Maryland
Distribution: Slackware
Posts: 7,803
Blog Entries: 1

Rep: Reputation: 417Reputation: 417Reputation: 417Reputation: 417Reputation: 417
If your running Slackware 10, you have iptables. Ipchains is obsolete and hasn't been used by most distros for a couple of years.

To get this working you need to do two things. First, make sure your router forwards port 21 to the IP address of your FTP server (you only need TCP).

The second, and harder, bit is to make sure that the firewall on your FTP server allows inbound traffic on port 21. Have you actually created a firewall? Slackware doesn't have one by default, so if you're not sure what you have in place for a firewall, have a look at the output of iptables -L

Now the really tricky bit is if you have clients trying to use PASV mode. For more info on how to properly set up PASV so that it has a restricted number of ports, I would strong suggest you read this tutorial. It covers proftpd in good depth and I believe that is what Slackware 10 uses.

<edit>
D'OH....I just re-read your first post where you say you are using vsftp. You'll have to check out their documentation about how to limit the PASV ports. By the way, you will also have to have your router forward the ports used in PASV mode to the FTP server along with port 21 and you'll have to allow them on your firewall as well.
</edit>

Last edited by Hangdog42; 03-07-2005 at 09:25 PM.
 
Old 03-08-2005, 01:40 PM   #9
dx0r515t
Member
 
Registered: Jan 2005
Location: USA
Distribution: Slackware 10.2 & 11.0
Posts: 155

Original Poster
Rep: Reputation: 30
well heres my output from the command iptables -L:
Quote:
root@dpc6682009075:~# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
root@dpc6682009075:~#
Does this mean I have a firewall setup or not? it looks like I accept everything....

I have the router set to forward port 21 to the FTP servers static IP address. Do you know of any tutorials that would help show me how to setup IPTABLES to allow inbound traffic on port 21?

What if I didn't want clients to be able to access the server with PASV mode? And instead I wanted to just tell them to uncheck use PASV mode from their client... how would I do that? Would I just simply leave the ports blocked that PASV mode requires?

BTW, thanks for putting up with all my questions.

Last edited by dx0r515t; 03-08-2005 at 01:45 PM.
 
Old 03-08-2005, 01:49 PM   #10
dx0r515t
Member
 
Registered: Jan 2005
Location: USA
Distribution: Slackware 10.2 & 11.0
Posts: 155

Original Poster
Rep: Reputation: 30
sorry for the double post, but also my vsftpd.conf file says
Quote:
connect_from_port_20=YES
does this mean I need to set the private port to 20 on my router? and inbound port to 21? or both to 21?
 
Old 03-08-2005, 03:27 PM   #11
Hangdog42
LQ Veteran
 
Registered: Feb 2003
Location: Maryland
Distribution: Slackware
Posts: 7,803
Blog Entries: 1

Rep: Reputation: 417Reputation: 417Reputation: 417Reputation: 417Reputation: 417
Quote:
Does this mean I have a firewall setup or not? it looks like I accept everything....
You don't have a firewall in place, pure and simple. As an aside I would highly recommend you put one up. Since you're not familiar with iptables, I'd suggest you install firestarter, which is a nice graphical interface that allows you to build a firewall. The good news is that we can rule the local firewall out as a source of trouble and you don't have to allow port 21 until you get a firewall in place.

If I remember correctly, FTP works on two ports. Port 21 is used to for the initial communication and then either port 20 (in normal mode) or some random high ports(in pasive mode) are used for data. For vsftp, I believe there is a directive that turns passive mode on and off. If you don't want to use passive mode, try setting that to no. Then you'll probably need to forward port 20 from your router to your FTP server.
 
Old 03-08-2005, 04:32 PM   #12
dx0r515t
Member
 
Registered: Jan 2005
Location: USA
Distribution: Slackware 10.2 & 11.0
Posts: 155

Original Poster
Rep: Reputation: 30
Ok as of right now I get this error when trying to connect by using my internet IP address from an FTP client I get "Connection refused"

This is confusing in my router setup I have under "virtual server" the inbound port set to 21, the connection type set to TCP, and my private port set to 20, and then of course I have the static IP of the server in my LAN set in that same section. And again the FTP server works perfect from inside my LAN.....

Maybe I have a setting wrong in vsftpd.conf?
Quote:
# Allow anonymous FTP? (Beware - allowed by default if you comment this out).
anonymous_enable=YES
#
# Uncomment this to allow local users to log in.
#local_enable=YES
#
# Uncomment this to enable any form of FTP write command.
write_enable=YES
#
# Default umask for local users is 077. You may wish to change this to 022,
# if your users expect that (022 is used by most other ftpd's)
local_umask=022
#
# Uncomment this to allow the anonymous FTP user to upload files. This only
# has an effect if the above global write enable is activated. Also, you will
# obviously need to create a directory writable by the FTP user.
anon_upload_enable=YES
#
# Uncomment this if you want the anonymous FTP user to be able to create
# new directories.
anon_mkdir_write_enable=YES
#
# Activate directory messages - messages given to remote users when they
# go into a certain directory.
dirmessage_enable=YES
#
# Activate logging of uploads/downloads.
xferlog_enable=YES
#
# Make sure PORT transfer connections originate from port 20 (ftp-data).
connect_from_port_20=YES
#
# If you want, you can arrange for uploaded anonymous files to be owned by
# a different user. Note! Using "root" for uploaded files is not
# recommended!
#chown_uploads=YES
#chown_username=whoever
#
# You may override where the log file goes if you like. The default is shown
# below.
xferlog_file=/var/log/vsftpd.log
#
# If you want, you can have your log file in standard ftpd xferlog format
#xferlog_std_format=YES
#
# You may change the default value for timing out an idle session.
idle_session_timeout=600
#
# You may change the default value for timing out a data connection.
data_connection_timeout=120
#
# It is recommended that you define on your system a unique user which the
# ftp server can use as a totally isolated and unprivileged user.
# nopriv_user=ftpsecure
#
# Enable this and the server will recognise asynchronous ABOR requests. Not
# recommended for security (the code is non-trivial). Not enabling it,
# however, may confuse older FTP clients.
#async_abor_enable=YES
#
# By default the server will pretend to allow ASCII mode but in fact ignore
# the request. Turn on the below options to have the server actually do ASCII
# mangling on files when in ASCII mode.
# Beware that turning on ascii_download_enable enables malicious remote parties
# to consume your I/O resources, by issuing the command "SIZE /big/file" in
# ASCII mode.
# These ASCII options are split into upload and download because you may wish
# to enable ASCII uploads (to prevent uploaded scripts etc. from breaking),
# without the DoS risk of SIZE and ASCII downloads. ASCII mangling should be
# on the client anyway..
#ascii_upload_enable=YES
#ascii_download_enable=YES
#
# You may fully customise the login banner string:
ftpd_banner=Welcome to the server.
#
# You may specify a file of disallowed anonymous e-mail addresses. Apparently
# useful for combatting certain DoS attacks.
#deny_email_enable=YES
# (default follows)
#banned_email_file=/etc/vsftpd.banned_emails
#
# You may specify an explicit list of local users to chroot() to their home
# directory. If chroot_local_user is YES, then this list becomes a list of
# users to NOT chroot().
#chroot_list_enable=YES
# (default follows)
#chroot_list_file=/etc/vsftpd.chroot_list
#
# You may activate the "-R" option to the builtin ls. This is disabled by
# default to avoid remote users being able to cause excessive I/O on large
# sites. However, some broken FTP clients such as "ncftp" and "mirror" assume
# the presence of the "-R" option, so there is a strong case for enabling it.
#ls_recurse_enable=YES
listen=YES
chroot_local_user=YES
pasv_enable=NO
Also I know I don't have a firewall right now, but I don't want to set a firewall up until I can get this thing to work from the internet first. Or is it required to have a firewall for this to work? I just want to see if I can get it to work first......I will set a firewall once I know this works...

EDIT: BTW I finally figured out how to disable passive mode check my last line in vsftpd.conf... it looks like it works (at least from inside my LAN)

Last edited by dx0r515t; 03-08-2005 at 04:34 PM.
 
Old 03-08-2005, 05:16 PM   #13
dx0r515t
Member
 
Registered: Jan 2005
Location: USA
Distribution: Slackware 10.2 & 11.0
Posts: 155

Original Poster
Rep: Reputation: 30
just noticed this in the client log file (this is connecting through the LAN):
Quote:
220 Welcome to the server.
USER anonymous

331 Please specify the password.
PASS xxxx
230 Login successful.
SYST

215 UNIX Type: L8
TYPE I

200 Switching to Binary mode.
PWD

257 "/"
PORT 192,168,2,50,131,52

200 PORT command successful. Consider using PASV.
LIST -aL

150 Here comes the directory listing.
226 Directory send OK.
THe part that interested me was this:
Quote:
PORT 192,168,2,50,131,52

200 PORT command successful. Consider using PASV.
Its interesting it lists those ports the static IP address of the server is 192.168.2.50 which accounts for the first four ports... but what about those last two the 131 and 52? Do those two ports need to be forwarded to my FTP server as well as port 21?
 
Old 03-08-2005, 08:39 PM   #14
Hangdog42
LQ Veteran
 
Registered: Feb 2003
Location: Maryland
Distribution: Slackware
Posts: 7,803
Blog Entries: 1

Rep: Reputation: 417Reputation: 417Reputation: 417Reputation: 417Reputation: 417
Just for entertainment, I'd have a read through this explanation of active and passive FTP modes and the advantages and disadvantages of each.

Quote:
This is confusing in my router setup I have under "virtual server" the inbound port set to 21, the connection type set to TCP, and my private port set to 20, and then of course I have the static IP of the server in my LAN set in that same section
I have to admit that this confuses me as well. I have no idea if "virtual server" is the same thing as port forwarding and "private port" must be something that the manufacturer dreamed up. To be honest, you're going to have to spend some time reading about your router because you do need to forward both 20 and 21 to the FTP server and if that isn't happening, you aren't going to get a connection. From what I know of vsftpd, your config file looks fine. The fact that you can connect from within your LAN suggests it is fine too.

Quote:
PORT 192,168,2,50,131,52
That is odd since if you are running in active mode, I thought that the 192,168,2,50 should be the IP address of the client, not the server. If you read through the link, you'll find that the last two digits are not individual port numbers, but you can do a little math with them to find what port the client is using. Again, with active mode, the server should only use 20 and 21.


If it helps, I run a server, and the relavant portions of my vsftpd.conf are this:

pasv_enable=YES
pasv_min_port=50000
pasv_max_port=51000
pasv_address=xxx.xxx.xxx.xxx (This should be your WAN IP address)

Basically I've used the min and max port commands to limit the range that passive mode can use and then I have my router forward that range to my FTP server (along with port 21).

Again, I think you're probably tripping up with your router and you need to do some digging on how your router does port forwarding.
 
Old 03-08-2005, 09:29 PM   #15
dx0r515t
Member
 
Registered: Jan 2005
Location: USA
Distribution: Slackware 10.2 & 11.0
Posts: 155

Original Poster
Rep: Reputation: 30
My bad man, I guess I shouldn't have posted this part: PORT 192,168,2,50,131,52 from the server lol I should have done it from a client....
well that explains why those "ports" are the same as my servers static IP address.... thanks for that I will read through your link it is very much apprecriated.
I had a feeling it was my router screwing up somehow.....(F*** belkin) its the belkin F5D7230-4 router.... I have unforunately heard rumors that this router doesn't support port forwarding.... I need to do a little research on this. But just to let you know I actually wasn't forwarding port 20 and 21 to my server.... I was just forwarding port 20 under the "private port" because I figured thats refering to my internal LAN and since my vsftpd.conf file said connect from port 20... I didn't think to forward port 21 as well. I've tried both but not at the same time. I will definetely read the routers manual and see if/how it supports port forwarding and as well I will check google.

If I find out the router doesn't support port forwarding what router do you suggest I buy if I want to be able to forward ports?

Again as always, thanks for all replys

EDIT: Thanks Hangdog42, you've been helpful.

Last edited by dx0r515t; 03-08-2005 at 09:39 PM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
vsftpd SETUP gurumaster Linux - Networking 20 01-21-2009 12:54 AM
iptables - servers not accessible from lan using external ip rubella Linux - Security 6 12-12-2005 09:16 PM
vsftpd setup davidhk Fedora 1 08-06-2005 05:13 AM
VSFTPD Setup carlosinfl Linux - Networking 3 07-22-2005 06:53 AM
Setting up a webserver inside a lan, which should be accessible from outside seidren Linux - Networking 2 05-18-2004 08:26 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 08:47 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration