[Xitami] FTP-passive mode

[Andreas Zieritz]

Ewen McNeill wrote:

> In message <3BBB0C12.FC98DF56@sovik.no>, Andreas Zieritz writes:
> >We have moved our Xitami Webserver behind a firewall (see
> >www.smoothwall.org) and we do have some troubles with the FTP part. What
> >we have found out is that some FTP clients do have a problem in
> >establishing a communication with the Xitami server. FTP-clients
> >operating in passive mode are not experiencing these problems.
> >We have opened ports 20 and 21 on the firewall. Are there any other
> >ports that should be open?  Any hints concerning passive mode?
>
> I'm a little puzzled as to what your problem is; you say "FTP-clients
> operating in pasive mode are not experiencing these problems", but also
> say "Any hints concerning passive mode?".
>
> The FTP protocol is _really_ not designed to go through firewalls (it
> was designed well before anyone had even thought of the need for
> firewalls, let alone actually designed a firewall).  You should probably
> seriously consider whether you can do what you want with HTTP instead of
> FTP.
>
> If you still want to use FTP you need to remember that there are two
> modes of FTP:
> 1. Active FTP:  control connection open from client->server; if the client
>    wants to download something, the client picks a port number at its,
>    end and the server connects to that port, and sends the file.  If the
>    client wants to upload something the server picks a port number at
>    its end, and the client connects to that.  (Ie, the connection for
>    transfering the data always opens in the connection the data is being
>    sent.)
>
> 2. Passive FTP: control connection open from client->server; if the
>    client wants to download something the server picks a port number at
>    its end, and tells the client to connect there to "pull" the file
>    back.  If the client wants to upload something the server picks a
>    port number at its end, and the client connects to that.  (Ie, the
>    connection for transfering data is always opened from the client to
>    the server.)
>
> Using passive mode usually gets around most problems with firewalls at
> the _client_ end.  But it causes complications if there is also a
> firewall at the _server_ end.
>
> There are two basic complications caused by passive FTP when the server
> is behind a firewall:
> 1. The port that is picked by the FTP server may not be allowed through
>    the firewall.  Since the FTP server needs to allow more than one
>    connection at a time, this may mean multiple ports need to be allowed
>    through the firewall.
>
> 2. If the firewall is doing NAT, the address given out to connect to by
>    the FTP server will probaly be an internal address, not an external
>    one, and thus not usable.
>
> The main complication caused by active FTP is at the client end, where
> their firewall may not allow an incoming connection to whatever port the
> client picks; but many firewalls can handle this automatically.
>
> Debugging this sort of thing generally requires snooping on the TCP/IP
> traffic at one or both ends, and figuring out what each end is trying to
> do.
>
> Generally it's all too hard; and if you're going to have your server
> behind a firewall you probably want to avoid using FTP.
>
> Ewen
>
> --
> Ewen McNeill, Technical Consultant, iMatix Corporation  www.imatix.com
>
> --
> Xitami Users Mailing List -- For Xitami support
> To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami

Thank you very much for this very useful lesson, Ewen!

--
Servus,
 Andreas

------------------------
Andreas Zieritz
Siviling. Svein Sovik AS
Fantoftveien 42
N-5072 Bergen
http://www.sovik.no