FTP Active Mode Not Working

[rmmoore80]

Running Plesk 8.1, IIS FTP and Gene6 FTP (tried both, same problem).

If I connect to the FTP server using active mode, running either version, it stops at the list /bin/ls command. I then get an error 425 Can't open data connection.

If I connect using passive, it works. I want to give my customers the option to use either one. I disabled the server firewall and this still occured. Any suggestions? Or, is one safer or in any way better than the other?

Here is the log:

! Connecting to xx.xxx.xxx.xx...
< 220 Microsoft FTP Service
> USER ryanmoore_com
< 331 Password required for xxxx.
> PASS (hidden)
< 230 User xxxx logged in.
> SYST
< 215 Windows_NT
> PWD
< 257 "/" is current directory.
> PORT 192,168,1,101,11,11
< 200 PORT command successful.
> LIST
< 150 Opening ASCII mode data connection for /bin/ls.
< 425 Can't open data connection.
! RETR/LIST/NLST Failed
> PWD
< 257 "/" is current directory.
> PORT 192,168,1,101,11,14

 

[rmmoore80]

I discovered the wierdest thing...

Active Mode does not work ONLY from my primary laptop. All other PC's it does work. On my laptop I uninstalled Norton Internet Security, disabled windows firewall, and disabled NAT on my firewall. It still does not work. Passive mode works fine.

 

[LeaUK]

From your logs it appears your server is running behind a router on NAT (192.x.x.x).

The log shows typically a firewall issue by proceeding to the List command but not getting any further. You will also get this if attempting PASV without specifying the return WAN IP - see below

By running PASV mode you generally have to tell the FTP server app what 'real' IP you have so it can return the correct IP instead of the LAN address. I suspect you have configured this correctly. Tip, also specify a range of ports the server can use for PASV so you can open them in your server firewall, otherwise your FTP server 'may' chose random ports and communication will then be blocked again!

Anyway, back to Active mode, it fails due to the client being behind a NAT. In fact to test this I configured a server on a WAN and tried to connect via Active mode only, it stuck at list. My client is on a LAN (192).

I configured two machines on WAN IPs and connected to each other using server + client without problem using Active, therefore I conclude it's the client's 192 address causing the issue.


You must use PASV if clients are on NATs, which these days most are.

Lea