Trying to setup FTP behind linux router

[Screwdriver]

Someone please school me on how ftp works - I am about to rip my hair out.

I have a copy of coyote linux. It works great as a router/firewall for my home network. I have posted a few times on their web forum, but have not resolved anything.

I am having the hardest time setting up an ftp server. I am using WARftp. I have setup web and telnet before, and they both work great.

I have the following port forwarding rules in my setup:

ipmasqadm autofw -A -r tcp 20 21 -h 192.168.0.10
ipmasqadm autofw -A -r udp 20 21 -h 192.168.0.10

The ftp server ALMOST works.

Unfortunatly, I cannot connect to my internet ip while behind the router so testing it can be interesting at times. I can connect to my local ip (192.168.0.10) from my LAN and the ftp works flawlessly. Anyway, from the outside, anyone can connect to the ftp server. If using window's dos command line ftp client, the ftp server works absolutly fine as well. If using any other client (ws, cute ftp etc.) people can connect, but get completly stuck when doing the first 'ls' command. It just sits there and eventually times out. It does this from everywhere I have tried it. Again, dos ftp sessions WORK PERFECTLY FINE. I can d/l, u/l, everything. Most of the clients have some 'warftp' specific options, but they change nothing.

This is what ws_ftp says after it logs in (while connecting from work to my house):

PASV
227 Entering Passive Mode (192,168,0,10,9,14)
connecting to 192.168.0.10:2318
! Connection failed 192.168.0.10 - connection timed out
! connect: error 0

Ill be honest by saying that I don't really know whats going on here. Im going to assume that 192,168,0,10 is my local ip. The ",9,14" kinda scares me. What really really scares me is the ":2318" my guess is that this is a port or something like that, and its ALWAYS DIFFERENT. If I cancel and reconnect that number is different right away. If this is the case, I don't see how it would be possible to open it up on the firewall.

Any ideas? Thanks in advance.

 

[Inter]

That is indeed a port, and it's different each time? Then the client which tries to connect to your ftp server must try with different ports for some reason. Since ftp'ing from DOS works, and the ftp program connects with port 21 as default, it must probably be on the client side, not the server side.

 

[Screwdriver]

I've read that ftp uses 21 for connetions, and 20 for data transfer. All of the clients are set to use port 21, (no other port settings are available from what I can see) and they definatly connect to the server fine. The little disclaimer message (that I typed) even pops up. My guess is that it chokes when it opens the first ascii transfer via 'ls'. I cannot figure it out. Is it common for FTP servers to work fine behind comericial firewalls?

 

[n0cmonkey]

There are 2 types of FTP, passive and active. Now I always get the two mixed up. But one uses port 21 for everything and the other uses port 21 and a random high port.

 

[gaidin123]

Try setting your FTP server to use a high port, like port 5000 or so as long as it's above port 1024. Forward that one port through your linux router to whatever your internal FTP server's IP is.

If command line DOS ftp works, the other ftp clients you're using either don't support passive ftp correctly, or you have your ftp server set up oddly. Try using Bulletproof FTP (www.bpftp.com). It's been the most reliable ftp client I've used under windows when others failed to work.

Passive ftp I believe uses just the 1 port for everything whereas active (normal) ftp uses the default port for control stuff and a randomly chosen by the ftp server high numbered port for the actual data transfer.

Good luck!

Gaidin

 

[n0cmonkey]

<< Try setting your FTP server to use a high port, like port 5000 or so as long as it's above port 1024. Forward that one port through your linux router to whatever your internal FTP server's IP is.

If command line DOS ftp works, the other ftp clients you're using either don't support passive ftp correctly, or you have your ftp server set up oddly. Try using Bulletproof FTP (www.bpftp.com). It's been the most reliable ftp client I've used under windows when others failed to work.

Passive ftp I believe uses just the 1 port for everything whereas active (normal) ftp uses the default port for control stuff and a randomly chosen by the ftp server high numbered port for the actual data transfer.

Good luck!

Gaidin >>



Thats what I thought too, but it seems everytime I say one type of ftp is a certain way Im wrong

If command line works, use it. Its easier anyhow.

 

[Damaged]

Errr, we're getting kind of confused here aren't we? Just read this old, but simply explained article from, of all people, Netscape, about the diff b/w passive and active. Using FTP through a firewall (passive FTP) Mostly because it saves me typing it all out for you and it keeps the post shorter.

Oh, and the DOS cli ftp client does not do passive. Most others will though, ncftp (my fav), cute, WS, bulletproof, etc., etc..