How to set up FTP forwarding on Pfsense?

Question

linux

Good afternoon.
2.1.3-RELEASE (i386)
When setting up forwarding to an FTP server, after changing its incoming port, the connection falls off.
Tried to change to another range, the situation is the same. What does port forwarding on RDP MS work with a bang. FTP server to spin on it.
Tell me what could be the problem?
I repeat, when configured from port 21 to port 21, everything works. Including when changing forwarding to rdp.
firezilla
At 21:
So I noticed that it has changed .... when changing ONLY the Destination port range, when accessing ftp, I saw that it was accessing the local IP, and not the External one.
Connecting from 62.xxxxxx:21...
Status: Connection established, waiting for prompt...
Response: 220 Microsoft FTP Service
Command: USER ftp1
Response: 331 Password required
Command: PASS *******
Response: 230 User logged in.
Command: OPTS UTF8 ON
Response: 200 OPTS UTF8 command successful - UTF8 encoding now ON.
Status: Connection established
Status: Getting list of directories...
Command: PWD
Response: 257 "/" is current directory.
Command: TYPE I
Response: 200 Type set to I
Command: PASV
Response: 227 Entering Passive Mode (62,XX,XX,XX,192,230)
Command: LIST
Response: 150 Opening BINARY mode data connection.
Answer: 226 Transfer complete.
Status: Directory list fetched
Status: Disconnected from server
At 6221 :
Status: Connecting with XXXXXXXXX:6221...
Status: Connected, waiting for prompt...
Response: 220 Microsoft FTP Service
Command: USER ftp1
Response: 331 Password required
Command: PASS *******
Response: 230 User logged in.
Command: OPTS UTF8 ON
Response: 200 OPTS UTF8 command successful - UTF8 encoding now ON.
Status: Connection established
Status: Getting list of directories...
Command: PWD
Response: 257 "/" is current directory.
Command: TYPE I
Response: 200 Type set to I.
Command: PASV
Response: 227 Entering Passive Mode (10,86,33,155,192,232).
Status: The server sent a passive response with an undefined address. I'm using an existing server address.
Command: LIST
Response: 150 Opening BINARY mode data connection.
Error: Data connection could not be established: ETIMEDOUT - Connection attempt timed out
Error: Connection timed out Error
: Failed to get directory listing
Tried to change port on server to 6221 nothing changed
with settings 6221 - 6221 same error BUT
at the FTP settings - 6221 everything is OK.
That is, the problem is precisely in the Destination port range item
So I ran and read ...
https://forum.pfsense.org/index.php?topic=73372.ms...
configured ports on ftp-nicknames and the situation has changed, but .... it still hangs.
Status: Connecting to 62.xxxxxx:6221...
Status: Connected, waiting for prompt...
Response: 220 Microsoft FTP Service
Command: USER ftp1
Response: 331 Password required
Command: PASS *******
Response: 230 User logged in.
Command: OPTS UTF8 ON
Response: 200 OPTS UTF8 command successful - UTF8 encoding now ON.
Status: Connection established
Status: Getting list of directories...
Command: PWD
Response: 257 "/" is current directory.
Command: TYPE I
Response: 200 Type set to I.
Command: PASV
Answer: 227 Entering Passive Mode (62,xxxxx,193,67).
Command: LIST
Response: 150 Opening BINARY mode data connection.
Error: Data connection could not be established: ETIMEDOUT - Connection attempt timed out
Error: Connection timed out Error
: Failed to get directory listing
ip external forwards, but apparently the port is tight. ..
Well, gentlemen, unfortunately, this is my first experience with unix \ linux-like systems and, as a result, the lack of both practice and theory. I tried to turn off debug.pfftpproxy and immediately I ran into the same point as on other ports. I have only two solutions to this problem:
1) If your experience and practice allows you to take a "deeper" look and see what forwarding we set in case of selecting the tab (FTP) on the Destination port range.
2) Or suggest how I can change this value itself. From port 21 to any other.
And in both cases, without you, "Guys", I can do without.
I hope for your help, thanks.

Answer 1

When working via the FTP protocol, two connections are established between the client and the server - a control connection (commands go through it) and a data connection (files are transferred through it).
The control connection is the same for Active and Passive mode. The client initiates a TCP connection from a dynamic port (1024-65535) to port number 21 on the FTP server and says "Hi! I want to connect with you. Here is my name and my password." Further actions depend on which FTP mode (Active or Passive) is selected.
In active mode, when the client says "Hello!" it also tells the server a port number (from the dynamic range 1024-65535) so that the server can connect to the client to establish a data connection. The FTP server connects to the specified client port number using TCP port number 20 for data transfer.
In passive mode, after the client says "Hello!", the server tells the client the TCP port number (from the dynamic range 1024-65535) to which it can connect to establish a data connection.
The main difference between active FTP mode and passive FTP mode is the side that opens the data connection. In active mode, the client must accept a connection from the FTP server. In passive mode, the client always initiates a connection.
Original source
Now you can answer your own question? =)
Posts are already stupidly copying. =) but if people don't understand how the protocol fumbles... then you need to give it a read.