Passive FTP Working Behind Router?

This is a common problem with NAT and passive FTP. Google will turn up hours of reading about references to this very problem.

I do not use Mac OS X Server to serve FTP. Instead I use PureFTPd on a regular OS X client. PureFTPd can be installed via Fink or from a binary installer.

The reason I use PureFTP [and previously ProFTPd] is because of the configuration they allow with regards to your very problem. The idea is that some FTP servers will do ‘IP Masquerading" which essentially means that the server will pass on a user defined IP address during the NAT translation back to the client who is connecting.

Instead of the clients seeing the private 192.168.x.x IP they will see the Masquerading IP and connect normally. At least that is the idea.

Both ProFTPd and PureFTPd can be substituted for the built in FTPd on OS X client, but Pure has the additional benefit of having no know exploits, support for virtual users, etc.

I have a few minutes to figure out if you can masquerade your FTP servers IP…

OSX Server uses a different FTP server than the one shipped with OS X Client [lukemFTPd], but I can not remember it of the top of my head. Might be WU-FTPd or a variant. Luckilly, OS X Server has some easy to configure options. So try this and see if it allows clients to connect:

edit the following file in a text editor:

/Library/FTPServer/Configuration/ftpaccess add this right above the “email user@address” line:

passive ports 49152 65534.

The rest needs to be done in the Server Admin>Firewall>Advanced tab:

Create a new rule with the following parameters:

Action – Allow
Protocol – TCP
Service – Other

Source Address – Any (or create separate rules for each allowed ftp user)
Source Port – Blank
Destination Address –

Interface – In

HTH

🙂

This is going to be a learning experience but I believe it is possible to fix your problem with ‘natd’ and ‘ipfw’. Read the man pages for the gory details.

I wish I could tell you more. I am not 100% certain how to do it but you need to have the proper firewall settings and then edit your natd config to successfully masquerade your WAN side IP to the incoming FTP requests.

Don’t give up, you can figure it out eventually! It can be done! 🙂

I have set up Pure-FTP on running under OSX 10.3.8 behind an Airport Extreme Basestation. I have shut off the firewall on the computer running the FTP server (Pure-FTP). I have run a number of tests with different configurations with the constants being the server settings, the Airport Extreme Basestation firewall settings (accepts both active and passive connections), and the server computer firewall being off. The variables are the client computer firewall (on,off); connection (intranet, internet); FTP client mode (active, passive); and the result (good connection with directory listing, error). The odd thing is that I seem to be able to connect with the terminal, authenticate and get a directory listing but when using an FTP client, although I can connect and authenticate, I cannot get a directory listing.

Here are the results:
Client Firewall Connection FTP client Result
Mode
1. on intranet passive good
2. on intranet active error
3. on internet passive error
4. on internet active error
5. off intranet passive good
6. off intranet active good
7. off internet passive error
8. off internet active good

Another odd thing that is happening is that under configuration 3 when the server responds to the client being in passive mode with the PASV command and enters passive mode and it sends out the “XXX.XXX.XXX.XXX.XXX.XXX”to tell the client which ports are being listened to, the second “XXX” does not match the second XXX in my router’s IP address but some other number gets inserted there. It appears that the server is telling the client that it is waiting for a connection at the wrong IP address with the listed ports. Then when I tell it to list the contents of the directory, the client goes out to the wrong IP address and tries to execute the list command and eventually times out because my FTP server is not there! I found that the server I am being directed to is in China! I have read and searched for days to find out why this is happening to no avail. Anyone have any idea what is happening and how to fix it?

After much headache I have got Xftpd on osx server working behind a firewall.

You need to alter you rftp access file in Library\ftpserver\configuration

Add following lines and this will work..

passive address 10.0.0.1 10.0.0.0/8 (Where 10.0.0.1 is your ftp server, this allows access locally.)
passive address 245.x.x.x 0.0.0.0/0 (Hint if you have a dyndns name add it instead of the ip address)

Then add restriction on your ports to narrow down number of ports required to be open on your firewall. eg..

passive ports 10.0.0.1 10.0.0.0/8 50000 65000
passive ports 245.x.x.x 0.0.0.0/0 50000 65000

Also other notes with xftps, recent security update change the http://ftp.plist file and set it back so loads ftpd which is the client config, you need to change this back to the default if your affected.

Also suggest you set your default settings back and then tweak them as required for the ftpaccess file, from ftpaccess.default.

If you wish to change the ports that ftp runs on your server, edit \etc\service and change the ports listed against ftp.

eg change to 1021

Enjoy… Hope this hlps people as this taken some days to get working again… but all good now..