FTP outside LAN

[aviationjames]

I have made my Raspberry Pi into a FTP Server, I would like to access it outside LAN, to store and retrieve my documents, etc.

 

I have opened up the ports, and I cannot access it.

 

It works from LAN, just not WAN. Please help

[Bloodyvalley]

you probably didnt open the ports properly

[aviationjames]

you probably didnt open the ports properly

Well it is a TalkTalk ISP router, so maybe. Under port triggering, I cannot add 21 as a port number, it just glows red, and I cannot save it. It only works on Port Mapping  

[aviationjames]

you probably didnt open the ports properly

Just checked, and they are open

[Bloodyvalley]

Just checked, and they are open

 

Passive FTP

In order to resolve the issue of the server initiating the connection to the client a different method for FTP connections was developed. This was known as passive mode, or PASV, after the command used by the client to tell the server it is in passive mode.

In passive mode FTP the client initiates both connections to the server, solving the problem of firewalls filtering the incoming data port connection to the client from the server. When opening an FTP connection, the client opens two random unprivileged ports locally (N > 1023 and N+1). The first port contacts the server on port 21, but instead of then issuing a PORT command and allowing the server to connect back to its data port, the client will issue the PASV command. The result of this is that the server then opens a random unprivileged port (P > 1023) and sends P back to the client in response to the PASV command. The client then initiates the connection from port N+1 to port P on the server to transfer data.

From the server-side firewall's standpoint, to support passive mode FTP the following communication channels need to be opened:

• FTP server's port 21 from anywhere (Client initiates connection)
• FTP server's port 21 to ports > 1023 (Server responds to client's control port)
• FTP server's ports > 1023 from anywhere (Client initiates data connection to random port specified by server)
• FTP server's ports > 1023 to remote ports > 1023 (Server sends ACKs (and data) to client's data port)

When drawn, a passive mode FTP connection looks like this:

In step 1, the client contacts the server on the command port and issues the PASV command. The server then replies in step 2 with PORT 2024, telling the client which port it is listening to for the data connection. In step 3 the client then initiates the data connection from its data port to the specified server data port. Finally, the server sends back an ACK in step 4 to the client's data port.

While passive mode FTP solves many of the problems from the client side, it opens up a whole range of problems on the server side. The biggest issue is the need to allow any remote connection to high numbered ports on the server. Fortunately, many FTP daemons, including the popular WU-FTPD allow the administrator to specify a range of ports which the FTP server will use. See Appendix 1 for more information.

The second issue involves supporting and troubleshooting clients which do (or do not) support passive mode. As an example, the command line FTP utility provided with Solaris does not support passive mode, necessitating a third-party FTP client, such as ncftp.

NOTE: This is no longer the case--use the -p option with the Solaris FTP client to enable passive mode!

With the massive popularity of the World Wide Web, many people prefer to use their web browser as an FTP client. Most browsers only support passive mode when accessing ftp:// URLs. This can either be good or bad depending on what the servers and firewalls are configured to support.

 

Source

[Neil]

You need to open port 20 and 21. The rest of the ports should be handled automatically over the protocol.

[aviationjames]

You need to open port 20 and 21. The rest of the ports should be handled automatically over the protocol.

I will try this, however it's the Pi is in a DMZ

[aviationjames]

You need to open port 20 and 21. The rest of the ports should be handled automatically over the protocol.

No, even with 20 doesn't work

[aviationjames]

Passive FTP

In order to resolve the issue of the server initiating the connection to the client a different method for FTP connections was developed. This was known as passive mode, or PASV, after the command used by the client to tell the server it is in passive mode.

In passive mode FTP the client initiates both connections to the server, solving the problem of firewalls filtering the incoming data port connection to the client from the server. When opening an FTP connection, the client opens two random unprivileged ports locally (N > 1023 and N+1). The first port contacts the server on port 21, but instead of then issuing a PORT command and allowing the server to connect back to its data port, the client will issue the PASV command. The result of this is that the server then opens a random unprivileged port (P > 1023) and sends P back to the client in response to the PASV command. The client then initiates the connection from port N+1 to port P on the server to transfer data.

From the server-side firewall's standpoint, to support passive mode FTP the following communication channels need to be opened:

• FTP server's port 21 from anywhere (Client initiates connection)
• FTP server's port 21 to ports > 1023 (Server responds to client's control port)
• FTP server's ports > 1023 from anywhere (Client initiates data connection to random port specified by server)
• FTP server's ports > 1023 to remote ports > 1023 (Server sends ACKs (and data) to client's data port)

When drawn, a passive mode FTP connection looks like this:

In step 1, the client contacts the server on the command port and issues the PASV command. The server then replies in step 2 with PORT 2024, telling the client which port it is listening to for the data connection. In step 3 the client then initiates the data connection from its data port to the specified server data port. Finally, the server sends back an ACK in step 4 to the client's data port.

While passive mode FTP solves many of the problems from the client side, it opens up a whole range of problems on the server side. The biggest issue is the need to allow any remote connection to high numbered ports on the server. Fortunately, many FTP daemons, including the popular WU-FTPD allow the administrator to specify a range of ports which the FTP server will use. See Appendix 1 for more information.

The second issue involves supporting and troubleshooting clients which do (or do not) support passive mode. As an example, the command line FTP utility provided with Solaris does not support passive mode, necessitating a third-party FTP client, such as ncftp.

NOTE: This is no longer the case--use the -p option with the Solaris FTP client to enable passive mode!

With the massive popularity of the World Wide Web, many people prefer to use their web browser as an FTP client. Most browsers only support passive mode when accessing ftp:// URLs. This can either be good or bad depending on what the servers and firewalls are configured to support.

Source

That seems confusing, and I don't know what to do from that

[Neil]

I will try this, however it's the Pi is in a DMZ

 

1. I seriously doubt it's *actually* in a DMZ.
2. Why is it in a "DMZ" inside your home network. That's not necessary.
3. What does the firewall look like on the Pi? (iptables --list)
4. What does your FTP server config look like?

[aviationjames]

• I seriously doubt it's *actually* in a DMZ.
• Why is it in a "DMZ" inside your home network. That's not necessary.
• What does the firewall look like on the Pi? (iptables --list)
• What does your FTP server config look like?

The DMZ is for Plex to allow remote access.

How can I see my configuration?

[aviationjames]

• I seriously doubt it's *actually* in a DMZ.
• Why is it in a "DMZ" inside your home network. That's not necessary.
• What does the firewall look like on the Pi? (iptables --list)
• What does your FTP server config look like?

[.:MARK:.]

I have that talktalk router and ran it for a few days before I chucked it aside. Port forwarding really doesn't work well at all. Dynamic dns is broken and also truncates the last 2 characters of your password. Huawei HG633 right?

 

I suggest buying a HG612 modem and buying an off the shelf consumer router AP combo. That hardware from TalkTalk is broken shit.

[Neil]

_20150710_213119.JPG

 

You're going to need to run iptables as root.

 

sudo iptables --list

 

You really don't need a "DMZ" for plesk...

 

I don't know what FTP server you're running, so I can't tell you where to look for your configuration.

[D1NZ]

also check if your ISP is blocking any of those ports to be used.

[aviationjames]

also check if your ISP is blocking any of those ports to be used.

I phoned up, and they don't. I tried doing it on Windows using FileZilla server, and it wont work from WAN

[D1NZ]

I phoned up, and they don't. I tried doing it on Windows using FileZilla server, and it wont work from WAN

 

Maybe try turn off DMZ and troubleshoot one thing at a time.

[aviationjames]

Maybe try turn off DMZ and troubleshoot one thing at a time.

Still not working, have turned off router firewall, and all the ports are open now. What would be the next step? because I still cannot connect via FileZilla

[.:MARK:.]

The router is a broken pile of crap, ditch it and get better hardware.

[D1NZ]

Still not working, have turned off router firewall, and all the ports are open now. What would be the next step? because I still cannot connect via FileZilla

 

That's pretty much everything you could do, next I would look into your router firmware see if there  is a port forwarding issues or bugs.

First try updating the firmware.

If that still not working I would try completely different router. 

[.:MARK:.]

Again, that router is broken, TalkTalk has botched the firmware.

[aviationjames]

Again, that router is broken, TalkTalk has botched the firmware.

Yes, correct. I phoned them up, and they said they have the additional feature in the router but they don't support it