Irule passive ftp range data port

Hi @Gonzalex, first for all, thanks for answer me.

Our Ftp Servers have Pasv_ports defined, so the client receive the pasv_address and the port range that need to go via passive mode.

When I configured the VIP with the preffered configuration to FTP ( Ftp profile ) ( type: standard) (tcp profile ) ( translation auto-map ), the client received a RST ACK trying to do " quote pasv ". If I do the same bypassing the LB, the client receive the port range for passive and connect to the server without issues in pasv mode.

Reading some post about it in this forum, i tried with different combinations, but always with the same results.

So now i have this working with the following configuration

Vip-> Perfomance Layer4 , FastL4 profile, Auto-map, All services. or Vip-> Standard , Tcp profile

If i try to add Ftp profile ( default or with data port "0" ) or if i change the VIP service to FTP, i automatically receive RST ACK from the LB. ( I have also configured a Irule in the VIP that allows port ranges 20-21 & 30001-30020 )

Ok matey. Let me lab this stuff. I'll get back to you. I'm intrigued :)

Thanks :) I'm using vsftpd to the ftp servers with this added configuration

anonymous_enabled=YES pasv_address="Your LB public ip" pasv_min_port=30009 pasv_max_port=30020 pasv_enable=YES

Really thank you ! i hope that you not waste much time helping me. :)

I'm helping myself too ;) It's a good one. Aaaaight ... on it. will take some time to set it up...

just so i replicate like for like. Have you got the local firewall enabled or disabled?

Ftp instances no firewall, just iptables permitting those ports

Ok matey ... got this guy sorted! But you were right. There is something very fishy going on that even the Internet community seems to be fairly clueless about. I'd like to keep myself humble here - I found this solution by pure luck!!!

Initially, I was bumping into a lot of articles about bugs on the F5 itself, particularly dealing with passive FTP. But when checking the version those bugs would apply to, I could't match the code version i'm running - v11.6

Done also quite a few tcpdumps ... surely it was showing me the error but I failed to see it ... maybe I am tired of it LOL.

Luckily, after some configuration changes I noticed the following message: "227 Entering passive Mode (0,0,0,0,129,119)" - I knew that instead of 0.0.0.0, I was suppose to have the IP address of the server. This gave me new ideas...

I then tested the ftp connection from the f5 itself directly to the backend server. Was getting the same message! At this point, I knew it was an issue with vsftpd!

THE FIX

Edit the vsftpd.conf file and remove the pasv_address command. This fixed the problem for me.

My VS looks like this:

ltm virtual vs_ftp { destination 100.100.100.100:ftp ip-protocol tcp mask 255.255.255.255 pool pool_ftp profiles { ftp { } tcp { } } source 0.0.0.0/0 source-address-translation { type automap } translate-address enabled translate-port enabled vs-index 4 }

VSFTPD is running on CentOS - i've disabled firewalld as well using systemctl stop firewalld command. I don't have iptables running either.

So what can I say ... I hope this fixes the problem for you too.

Let me know! I'm dying to know!

Now ... if it doesn't work, try the following too; i didn't get to try these but I found these suggestions on other sites:

/etc/hosts.allow - add the line "vsftdp : ALL"

then reboot just to make sure.

Hi @Gonzalex , sorry for the delay, I was doing other stuff and i didn't check the email notification, sorry about that.

I replicated the exactly configuration that you posted and also i deleted the " pasv_address " on the ftp servers. The connection work as normal, but when you request enter into passive mode " quote pasv " ( via terminal ) or using a client like " FileZilla " , the connection die in my lab.

Here is my config:

ltm virtual TEST2-VS { destination 10.0.150.94:ftp ip-protocol tcp mask 255.255.255.255 pool TEST2-pool profiles { ftp { } tcp { } } source 0.0.0.0/0 source-address-translation { type automap } translate-address enabled translate-port enabled vs-index 3 }

I edited the file Host.allow too, but the result was the same.

Shall we find the solution or not, I would like to thank you for spending your time to help me

I will be here continue working on this and other issues that i have with this product hahaha :)

Hi Petak. When you say the connection dies, what do you mean? Are you getting different results than before? No more errors? Is it just the session that hangs? What version of code are you running?

Few more suggestions:

1. Upgrade the F5 - In my research, I did find a lot of other people having problems with Passive-FTP due to how translations are done or even due to the F5 not passing the correct PASV ftp string back to the client. For those people, the prob was fixed by an upgrade

    

2. My setup includes a one server pool only; try use one server as well ... just to rule out LB algorithms, persistency and things like that

    

3. Try another ftp server - don't just exclude the possibility of vsftpd being broken. Lots of people having Passive FTP probs with vsftpd

    

Other than that, I'm out of ideas. :(