[ previous ] [ next ] [ threads ]
 From:  Markus Fischer <markus at fischer dot name>
 To:  m0n0wall at lists dot m0n0 dot ch
 Subject:  Problem with active ftp
 Date:  Thu, 09 Jun 2005 10:41:36 +0200

I'm expiriencing a wierd situation with m0n0wall and active FTP 
connection to one of our partner hosts.

I'm opening the ftp connections are for some time (browsing to the 
rather big directory structure remotely) works. But often at one point, 
wenn the internal PORT command is issued the ftp client seems to hang 
and later stops because of a timeout.

Whenever this timeout happens, I find multiple entries in the firewall log:

block | WAN | remote-ip 21 | my-public-gatewat-ip 4000 | TCP

The port of the remote-ip is always 21, the port on the public ip of the 
gateway varies but is usually in the range 2000 to 4000 or so.

I have not set up any rule to block these. I even added a rule for 
testing to accept all packets from everything to everything, and still I 
got those reported as blocked in the firewall log.

I've tested multiple ftp clients, all exhibit the same problem. The 
administrator of the remote company said he did many hours of debugging 
at its best and could only come to the conclustion that he suspects a 
problem in the ftp-nat module of my firewall (m0n0wall). He says his 
firewall does state matching he can see that many tcp connections are 
not correctly initiated from our firewall; packets are dropped.

I'm using version 1.11, generic-pc.

thanks for any pointers,

- Markus