Problems with FTP server behind two routers

[pessoa]

Hi. I have two routers in my network before reaching to my private network. The first one has a public IP address at its wan1, and acts as a gateway for its internal interface. The second router (a Fortigate 50B) has a static IP at its wan1 interface and a static route to from 0.0.0.0 to its gateway (172.64.1.11). At this second router internal interface, I finally have my FTP server (configured for passive mode) with a 192.168.0.105 IP address. Bellow is a scheme that I' ve drawn to ilustrate this architecture: ----------------------------------------- ---------------------------------------- ------------------------------------------------ INTERNET -> | 189.165.215.80 RT1 172.64.1.11 | -> | 172.64.7.12 FG-50B 192.168.0.1 | -> | 192.168.0.105 FTP SERVER - WINDOWS 2008 R2 | ----------------------------------------- ---------------------------------------- ------------------------------------------------ Naturally I' ve routed all the necessary ports in both routers so the connection requests from the internet can reach my FTP server. Anyway, the problem that I' m having is that whenever I try to connect my FTP server from the internet, Filezilla keeps trying to connect to the passive mode with the ip 172.64.7.12, that is the wan 1 ip address of the closest router to my FTP server, the Fortigate 50 B. I' ve also tryied on configuring the " External IP Address of Firewall" ip address at my FTP server, but the address is always changed to 172.64.7.12. Bellow follows my connection log. Estado: A resolver o endereço de ftp.mycompany.com Estado: Conectando 189.165.215.80:21... Estado: Conexão estabelecida, esperando mensagem de boas-vindas... Resposta: 220-Microsoft FTP Service Comando: USER USER Resposta: 331 Password required for USER. Comando: PASS ******** Resposta: 230-Welcome! Resposta: 230 User logged in. Comando: SYST Resposta: 215 Windows_NT Comando: FEAT Resposta: 211-Extended features supported: Resposta: LANG EN* Resposta: UTF8 Resposta: AUTH TLS;TLS-C;SSL;TLS-P; Resposta: PBSZ Resposta: PROT C;P; Resposta: CCC Resposta: HOST Resposta: SIZE Resposta: MDTM Resposta: REST STREAM Resposta: 211 END Comando: OPTS UTF8 ON Resposta: 200 OPTS UTF8 command successful - UTF8 encoding now ON. Estado: Conectado Estado: Obtendo lista de pastas... Comando: PWD Resposta: 257 " /" is current directory. Comando: TYPE I Resposta: 200 Type set to I. Comando: PASV Resposta: 227 Entering Passive Mode (172,64,7,12,128,106). Comando: LIST Resposta: 150 Opening BINARY mode data connection. TIMEOUT What should I do in order to have my FTP server working? Regards, Vinicius Pessôa.

[edsouza_FTNT]

RT1 does not look like it does NAT filtering for FTP. You did not explain if you set up NAT on RT1?

[pessoa]

Hi edsouza. First of all, thank you very much for helping us. I probably don' t have NAT filtering for FTP at RT1 and certainly nothing like that configured in FG-50B. I honestly didn' t know that such feature was required. Both RT1 and FG-50B has NAT enabled. Enabling this NAT filtering for FTP in RT1 would solve my problem? Is there a FG-50B level solution? I' ld like to avoid modifying configurations in RT1 if possible. Regards, Vinicius Pessôa

[rwpatterson]

As a thought, try turning off NAT on both units. Let the native addresses through.

[pessoa]

Thank you rwpatterson, I' ll give it a shot. I need do disable nat on my internet->lan policy of both devices then, right? Anything has to be done in my lan->internet firewall policy? Regards, Vinicius Pessôa

[rwpatterson]

Not sure about your first device, but yes, in the FGT, just the inward policy is all you need to touch. The return traffic passes back through the same policy.

[pessoa]

Hi everyone. I' ve tryied disabling nat in the incoming policy of both routers. Still doesn' t work. Actually, now even the FTP connection (21) stopped working. Any ideas? Regards, Vinicius Pessôa.

[ede_pfau]

I don' t think this is going to work. With passive mode FTP the server opens a connection to the outside client. Your server only knows about his private IP address, and the client probably sees that and tries to reply to it, with no way of knowing where to route the traffic. What you could try is source NAT the server' s IP in the FG' s policy to 172.64.7.13 (unused IP), and NAT that in RT1 to your public IP. Make sure the return path gets NATed as well. This is just a crude sketch and might not be worth the trouble. Active FTP should work as is, though.

[pessoa]

Hi Ede. Thank you for helping me. Actually, the Windows FTP Server has a configuration field called " External IP Address of Firewall" . So, I' m setting my public IP in this field. This feature works when I' m connecting my server from my lan (it retrieves me the set IP for the passive connection). But when I' m on the other side of the routers, I always get the IP 172.64.7.12. Regards, Vinicius Pessôa.