Why is Passive Ftp not working

Jveas — Wed, 20 Mar 2024 16:22:44 GMT

Ive been having trouble stablishing a passive FTP connection with a host that resides in a public IP.

The connection itself works, but when i try to transfer or list a file i keep receiving reject from the firewall indicating error (227)

Ive followed the instructions on the sk on this error (227) which is https://support.checkpoint.com/results/sk/sk171375

Remove all FTP services from the rule and use only ftp service. If you want only to use Passive mode FTP, use only ftp-pasv service in the rule. (In addition, this applies if you do not use multiple services with the same port in the same rule.)

Despite the rule is matched, it still gets rejected, as soon as an ls command is issued on the session. High tcp ports are also allowed.

Keep receiving the the same message (227)

I understand that it get's rejected because the client is sending a port command when working in passive mode, but my linux is configured to work on passive mode and it works ok with other hosts... Also the connection from a network outside of the scope of the firewall also work.

I dont quite understand why does the host try to send a port command, even when the firewall detects it is a passive ftp connection, as it get matched with rule 6..

Wyh does this happen?

Re: Why is Passive Ftp not working

the_rock — Thu, 21 Mar 2024 00:48:19 GMT

Can you do zdebug to see if it gives specific reason for the drop?

Andy

Re: Why is Passive Ftp not working

PhoneBoy — Thu, 21 Mar 2024 01:07:39 GMT

The reject message specifies the exact reason: because a PORT command is received when PASV mode is expected based on the fact you’re only allowing Passive mode via the Access Policy.
The service matched ftp-pasv because that’s what you have in your policy.
It uses the same port as regular FTP, just with different enforcement logic, namely PORT commands are not allowed with PASV.

This is expected behavior.

topic Re: Why is Passive Ftp not working in Firewall and Security Management

Why is Passive Ftp not working

Re: Why is Passive Ftp not working

Re: Why is Passive Ftp not working