Passive FTP-Custom Service?

[MitchK]

On my Fortigate 300A, I have an FTP server with internal addressing on an internal interface. I set up a VIP with an external (internet routable) IP address so that users on the internet can access the server. The firewall rule specifies only " FTP" as the service. Things were working well, until someone pointed out that when a user switches to passive FTP, they get a response from the server using its internal address. Obviously, I don' t want this to happen. Is the reason that my rule only includes garden-variety FTP? I don' t see a pre-defined service for passive FTP. If I change my rule to service " ANY" will that solve the issue? Thanks.

[ede_pfau]

No, it' s not the service definition. You just have to NAT outgoing traffic that is initiated by the server (in contrast to traffic replies). For active FTP, the VIP translates the source IP of reply traffic from your server to the VIP address. For passive ftp, you have to NAT the traffic manually. This is how: - create an " IP pool" with just one IP address, namely the VIP address (a.b.c.d/32) - edit the policy ' internal' ->' wan' which is used by your server to access the internet - check the NAT option, specify ' dynamic NAT' and choose the IP pool with the VIP address Depending on the protocol details passive ftp might use the ' wan' ->' internal' policy which uses the VIP instead of an outgoing policy. You can enable dynamic NAT on that policy as well, with no negative side effects.

[MitchK]

Thanks Ede, sounds right...I implemented it.

[MitchK]

Ede, another question. I already had a rule for internal->external, All to All, service ANY, with " interface NAT" configured. Until now, it was the only outgoing rule. Why wouldn' t the external user have seen the external interface' s address, rather than the server' s actual internal address?

[ede_pfau]

That indicates that passive ftp uses the ' wan' ->' internal' policy, configure NAT here (see my post above). Anybody following this thread must think two woodchoppers are handling hi-tech equipment...what a Friday... edit: see here http://slacksite.com/other/ftp.html for the passive ftp protocol. Both active and passive ftp use the same incoming policy from WAN to server - so that' s where the NAT belongs to. Definitely.

[MitchK]

Ede, because I AM a woodchopper, I will go over what I did. I created a custom service, FTP-PASV, delineating the port range allowed by my server. Then I added a rule in WAN->Internal: source=any destination=FTPserver (VIP) service=FTP-PASV I think that should do it. No?

[ede_pfau]

Good humor tackles everything. If you had included the definition for FTP-PASV I could' ve rated it. But FTP (default) should do.

[MitchK]

Here it is. The destination port range is specified on the server. I' m not sure how default-FTP would do it. Although one is not permitted to see how that service is defined, is passive factored into it? If so, I don' t have to create this new service.