[Xitami] FTP-passive mode

[Ewen McNeill]

In message <3BBB0C12.FC98DF56@sovik.no>, Andreas Zieritz writes:
>We have moved our Xitami Webserver behind a firewall (see
>www.smoothwall.org) and we do have some troubles with the FTP part. What
>we have found out is that some FTP clients do have a problem in
>establishing a communication with the Xitami server. FTP-clients
>operating in passive mode are not experiencing these problems.
>We have opened ports 20 and 21 on the firewall. Are there any other
>ports that should be open?  Any hints concerning passive mode?

I'm a little puzzled as to what your problem is; you say "FTP-clients
operating in pasive mode are not experiencing these problems", but also
say "Any hints concerning passive mode?".

The FTP protocol is _really_ not designed to go through firewalls (it
was designed well before anyone had even thought of the need for
firewalls, let alone actually designed a firewall).  You should probably
seriously consider whether you can do what you want with HTTP instead of
FTP.

If you still want to use FTP you need to remember that there are two
modes of FTP:
1. Active FTP:  control connection open from client->server; if the client
   wants to download something, the client picks a port number at its,
   end and the server connects to that port, and sends the file.  If the
   client wants to upload something the server picks a port number at
   its end, and the client connects to that.  (Ie, the connection for
   transfering the data always opens in the connection the data is being
   sent.)

2. Passive FTP: control connection open from client->server; if the
   client wants to download something the server picks a port number at
   its end, and tells the client to connect there to "pull" the file
   back.  If the client wants to upload something the server picks a
   port number at its end, and the client connects to that.  (Ie, the
   connection for transfering data is always opened from the client to
   the server.)

Using passive mode usually gets around most problems with firewalls at
the _client_ end.  But it causes complications if there is also a
firewall at the _server_ end.

There are two basic complications caused by passive FTP when the server
is behind a firewall:
1. The port that is picked by the FTP server may not be allowed through
   the firewall.  Since the FTP server needs to allow more than one
   connection at a time, this may mean multiple ports need to be allowed
   through the firewall.

2. If the firewall is doing NAT, the address given out to connect to by 
   the FTP server will probaly be an internal address, not an external
   one, and thus not usable.

The main complication caused by active FTP is at the client end, where
their firewall may not allow an incoming connection to whatever port the
client picks; but many firewalls can handle this automatically.

Debugging this sort of thing generally requires snooping on the TCP/IP
traffic at one or both ends, and figuring out what each end is trying to
do.

Generally it's all too hard; and if you're going to have your server
behind a firewall you probably want to avoid using FTP.

Ewen

-- 
Ewen McNeill, Technical Consultant, iMatix Corporation  www.imatix.com