FTP Problems: No directory listing/Can't 'get' files

[vlaganella]

I'm using a D-link DI-704 router and I have isolated the problem to the firewall itself by FTPing from within the LAN. When trying to connect via the internet I can successfully initiate an FTP session and login to the ftp server. When my FTP client tries to get a directory listing, the request times out. On the FTP server itself I get the error "421 Failed to create data connection socket". The same error occurs if I run a get command to download a file.

I followed instructions in the following article and opened up ports 20-24 and 789 with no change in symptoms:

http://www.tek-tips.com/gviewthread.cfm/lev2/5/lev3/34/pid/583/qid/294176

I am running Pablo's FTP Server but have seen the same symptoms using CesarFTP Server. FTP clients from Leech to DOS behave the same. Can anyone help?

 

[TheOldMan346]

vlaganella,

You did not mention whether you had tried both active and passive mode FTP and whether you were trying to use a non-standard port. Open up ports 50000 - 50100. FTP involves two connections; one for control and one for data. You are able to open the control socket since you are able to log in but you'll need to open the ephemeral ports so a data connection can be made.

Here is some info on Active vs Passive FTP

http://www.slacksite.com/other/ftp.html

Hope that helps.
The Old Man

 

[vlaganella]

I am operating in PASV mode. According to the manufacturer, the FTP client must be operating in a passive capacity for it to work with the built in firewall. Per your suggestion I opened ports 50000-50002 and tried using both ports 50000 and 50001 after reading the article you listed.

Same result. Good login but no data. I'm assuming that the configurable port is that of the control port since my symptoms move with my port number changes. Any suggestions on what to do with my data port config would be very helpful.

 

[TheOldMan346]

vlaganella,

Try opening up ports 50000 - 50100. It is a random high-order port that is chosen.
Can you copy the dialogue when you log in and get the failure and paste it back here? There may be a clue there.

The Old Man

 

[vlaganella]

Opened ports 50000-50100 with no effect. Here is the dialog in the FTP client from the start of the session to the time it drops the connection:

220 Welcome to Pablo's FTP Server
> USER vlaganella
< 331 Password required for vlaganella
> PASS *******************
< 230 User successfully logged in.
> REST 1
< 350 Restarting at 1.
> REST 0
< 350 Restarting at 0.
> SYST
< 215 UNIX emulated by Pablo's FTP Server.
> PWD
< 257 &quot;/&quot; is current directory.
~ Login completed.
> PORT 10,52,165,181,8,82
< 200 Port command successful.
> TYPE A
< 200 Type set to A
> LIST
< 150 Opening ASCII mode data connection for directory list.
! Socket Error: operation timed out or aborted
~ Could not retrieve directory listing for &quot;/&quot;
~ Disconnected

Here is the FTP server log for the same connection attempt:

06/11/2002 14:18:49.855 [636] 220 Welcome to Pablo's FTP Server
06/11/2002 14:18:49.965 [636] USER vlaganella
06/11/2002 14:18:49.975 [636] 331 Password required for vlaganella
06/11/2002 14:18:50.095 [636] PASS ***************
06/11/2002 14:18:50.095 [636] 230 User successfully logged in.
06/11/2002 14:18:50.155 [1432] Could not send reply, disconnected.
06/11/2002 14:18:50.155 [1432] Client disconnected from 198.133.108.129.
06/11/2002 14:18:50.215 [636] REST 1
06/11/2002 14:18:50.215 [636] 350 Restarting at 1.
06/11/2002 14:18:50.396 [636] REST 0
06/11/2002 14:18:50.396 [636] 350 Restarting at 0.
06/11/2002 14:18:50.516 [636] SYST
06/11/2002 14:18:50.516 [636] 215 UNIX emulated by Pablo's FTP Server.
06/11/2002 14:18:50.686 [636] PWD
06/11/2002 14:18:50.686 [636] 257 &quot;/&quot; is current directory.
06/11/2002 14:18:50.806 [636] PORT 10,52,165,181,8,82
06/11/2002 14:18:50.806 [636] 200 Port command successful.
06/11/2002 14:18:50.926 [636] TYPE A
06/11/2002 14:18:50.926 [636] 200 Type set to A
06/11/2002 14:18:51.047 [636] LIST
06/11/2002 14:18:51.057 [636] 150 Opening ASCII mode data connection for directory list.
06/11/2002 14:19:01.061 [636] 421 Failed to create data connection socket.
06/11/2002 14:20:51.169 [636] Client disconnected from 198.133.108.129.

 

[TheOldMan346]

vlaganella,

OK, this exchange indicates the data channel is being opened on port 2130 (8 x 256 + 82) which is not in the range of ports specified. This may be something with Pablo. I'm not familiar with that one. Technically, the server can use any port over 1024. Is there a setting in Pablo to to indicate the port range to be used? If not, you may want to try opening all ports > 1024 for outgoing use. If this works, you know it will work in principle and then can concentrate on limiting the range of open ports.

Hope that helps.
The Old Man