D-LINK 704 Cable Router and FTP

[nicks60610]

I can never connect to a remote FTP site since I installed my D-LINK 704 DSL/CABLE ROUTER, this is the error message I always get after the connection is established to the remote site:

227 Entering Passive Mode (192,168,0,159,5,122)
COMMAND:> LIST
STATUS:> Connecting data socket...
426 Connection closed (no data connection established).

I cannot get a response from D-LINK tech support as to why this suddenly happens, but when I disconnect the D-LINK, it works fine....any ideas??

 

[benzito]

Isn't the 704 also a Firewall? You may need to go into your advanced settings in the web interface and enable ftp or open the ftp specific ports. I'm speaking generally here as I have no direct experience w/ the dlink routers, but I know most of the new batch of cable routers have dhcp / nat / firewalling capabilites...

ftp-data 20/tcp File Transfer [Default Data]
ftp-data 20/udp File Transfer [Default Data]
ftp 21/tcp File Transfer [Control]
ftp 21/udp File Transfer [Control]

 

[TheOldMan346]

nicks60610,

What FTP software are you using? Is it an FTP client app or a web browser?

FTP clients use stanard FTP. They use port 20 to transfer the data and port 21 to pass control info. Web browsers typically use passive (PASV) mode for FTP. In PASV mode, you connect to the FTP server and the browser issues the PASV comand which instructs the server to use passive mode. The server then picks a random port and advises the browser which port it is listening on. The transfer then occurs on that random port. Based on the snippet of the error you included, you are running Passive mode and your firewall is blocking that random port. I don't know much about the D-Link's specifically but I would think it should handle this condition correctly. Check the configuration to see if there is a settingf to allow specific protocols and verify that FTP is enabled.

Here is a description of how FTP works.

http://www.phoneboy.com/docs/pasvftp.html

Hope that helps.
The Old Man

 

[nicks60610]

I am using CuteFTP and WS_FTP 32-bit - you are correct, the D-LINK is acting as a firewall, and I also have a software firewall doing most of the work. I did set port 789 (out) as a port that it should allow, but I will set 20 and 21 as well and see if it makes a difference - thanks for your help!

 

[TheOldMan346]

nicks60610,

Setting port 789 is not going to help. The bit of the error dialog you included indicates the FTP is in PASV mode. In this mode, it is a RANDOMLY CHOSEN HIGH NUMBERED port [in the case above - 1402] that is used and the choice of ports depends on the server. Chances are it will not be 789.

CuteFTP and WS_FTP are FTP client apps. What you should do is select the option to NOT use PASV mode.

Hope that helps
The Old Man

 

[TheOldMan346]

Actually, rethinking and rereading your posts, I don't believe it is the router causing the problem. As I said in the earlier post, about the D-Link "I would think it should handle this condition correctly". Under normal conditions, it would. Your last post provided the missing piece of the puzzle. The software firewall is blocking the transfer.

Hardware firewalls, such as the one running in the D-Link, generally don't block outgoing traffic. They are directed at blocking INCOMING attacks. That is why there is a market for personal firewall software. In PASV mode, it is the client software (WS_FTP and CuteFTP) that establishes the connection on the random port to do the transfer so it is an OUTBOUND connection. You opened 789 but not 1402 so it was blocked.

I don't know what software firewall you are using but if you can specify the rules per program, allow your FTP programs to open outbound connections on any port and you should be fine.

Hope that helps.
The Old Man

 

[nicks60610]

I am using Zone Labs ZoneAlarm Pro; but the problem is that when I disconnect the router and go directly from the cable modem to the PC, I can log in to the FTP site 789; and if I set it to use non-passive mode on the client, it fails as miserably as with the passive mode enabled . I will look at the software firewall and make sure the clients are allowed to communicate on any port.

I will try this later tonight or tomorrow, thanks for your ideas!

 

[nicks60610]

I checked the Zone Alarm settings and both clients were allowed to communicate on all ports. I changed it from passive to non and then it worked, but I also added the ports 21-24 and 789 as allowable ports on the Router. I think the issue is resolved - thanks for your help and explanation , one can never know enough about IT