PASV behind nat problem
FireFox
but when it switches to PASV mode my outgoing ip/port for data uses my
intranet address (192.168.x.x) instead of the WAN address. I've seen some
posts that there are ftp servers out there that are configurable to fix
this, but I would like to keep all my servers IIS. My question is with a
linksys router (8 port version, with the latest firmware) how do I get it to
translate the intranet address to the wan address.
Bernard
discussion, our expert - Alun Jones point out that problem using ftp passive
via NAT, is due to ALG - application layer gateway that supported by NAT
device. so you need to check if your linksys support that and ensure ftp
control port is bind to 21.
--
Regards,
Bernard Cheah
http://support.microsoft.com/
Please respond to newsgroups only ...
"FireFox" <fire...@charter.net> wrote in message
news:exPMRmHv...@TK2MSFTNGP11.phx.gbl...
news.shawcable.com
router DI-704P is not translating my internal IP address sent from my FTP
server (behind the router) to the WAN Public IP. Possibly due to a lack of
support for ALG??
I'm using the standard port 21, and have followed the DLink support
instructions for setting up a FTP server to a tee. I've search hi and low
for a setting in the Microsoft IIS Metabase that would allow me to hardcode
the IP address returned to the FTP client, but I've had no luck. Other
products like G6 FTP server do have these options and they work fine behind
my router.
I would also like to use the native FTP server that comes with IIS 6.0.
When I called the DLink support line the staff talked to me as though I was
the first person to have this issue! I find it hard to believe no one has
tried to setup an MS FTP server behind one of their routers before.
I've read a few post by Alun Jones, he seems to know quite a bit about NAT
and ALG, I guess he would suggest a better router? I'd still like to know a
little more before I return this hardware.
"FireFox" <fire...@charter.net> wrote in message
news:exPMRmHv...@TK2MSFTNGP11.phx.gbl...
Christopher Haun
Of course the best starting article about Passive and Active FTP is:
283679 Information About the IIS File Transmission Protocol (FTP) Service.
http://support.microsoft.com/?id=283679
One thing that it does not tell you is that IF your FTP server is IIS5 and
your Windows 2000 SP is SP4 (not SP3, not SP2, etc.) then you can specify
the port/ports that passive ftp will use. If you need to use the IIS5 FTP
server in passive mode between firewalls, you can fix the range of TCP
ports that the server uses for the data channel. You can fix it to a range
of your choice, as narrow as you desire—narrow even down to a single port
(between 1024 and 65535, I think).
If you want to pursue this at your own risk, back up your registry and . .
Bernard
but if the NAT doesn't support the ALG, will this setting overcome
the problem ?
as specifically doing a NAT from public to internal IP address that
we use to discuss in this group.
--
Regards,
Bernard Cheah
http://support.microsoft.com/
Please respond to newsgroups only ...
"Christopher Haun" <a-c...@microsoft.com> wrote in message
news:Hh6nnVpv...@cpmsftngxa07.phx.gbl...
robbieD
I have been struggling with this for dayz also behind a
linksys wifi router. It all has to do with masquerading
which is used in linux a lot and in Proftpd I can do this
within a minute. Also, as you said, other servers do the
same including raidenftp. I guess MS wants us to set our
servers up outside of our firewalls and not behind them. I
can't believe MS ftp service has no support for
masquerading our internal IP addy as our external IP addy.
Anyway, I have searched for dayz [like I said] I hope to
find a solution other than the usual reply of
"PassivePortRange" in the metabase very soon. Otherwise
this whole IIS 6 venture is a waste of my money!!!
Rob
>.
>
Bernard
related to ftp but rather then the NAT device.
and FYI. the most powerful thing about IIS6.0 is always
about the webserver. not ftp, smtp or nntp. these are
just provided as a basic entry. not fancy stuff.
--
Regards,
Bernard Cheah
http://support.microsoft.com/
Please respond to newsgroups only ...
"robbieD" <robb...@yahoo.com> wrote in message
news:040f01c3bf70$a946d5e0$a401...@phx.gbl...
robbieD
Hi Bernard,
I see you help a lot of people here! Yes the problem is with NAT. All is
fine if the server is on the public internet. Then when my server tries to
talk to a client, my server sends out my external IP. When my server is
behind NAT and a client isn't all is OK also. This is where PASV comes in.
The problem arises when both are behing a firewall/NAT. Then the client IP
and the server IP are broadcast with private IP's and everything gets
confused. In Linux or other windows servers, I can tell the server to
broadcast only my Outsided IP addy so no one gets confused. In Linux with
proftpd it is a simple switch/command called MasqueradeIP.
Now, I have gotten all to work if I keep my ftp server on port 21, [with a
lot of sweat/work] open up ports 20 and 21 And also ports 5000 to 65****.
[but who wants all those ports open?] Then when I use PassivePortRange in
the metabase all still seems to work OK at times. If I change from the
default port of 21 to say 2121 and I want my passive ports to be 2100-2120.
Then all hell breaks loose. MSFTP service is not flexible at all. The only
way to use it with any flexibility at all is to put it on the public
internet and I [for one] don't want any MS on the public internet all
alone!!!!!! If I could make sure all my ftp clients were not behind NAT,
then all would be well even with this inflexible ftp service With some elbow
grease.
I understand that IIS is mainly for web serving, but it would be very simple
for ms to put a little elbow grease into the other features to at least make
them usable. My gawd, there are millions of posts about pasv behind a
firewall on the internet and no useless information to get around it, other
than, "PassivePortRange" which is just minimizing a problem but still making
you use the port MS wants.
Rob
"Bernard" <qber...@hotmail.com> wrote in message
news:%23edAc84...@TK2MSFTNGP10.phx.gbl...
![Alun Jones [MS MVP]'s profile photo](http://lh3.googleusercontent.com/a-/ALV-UjV-wmVz8EMMybw9NF07ci6QEKOGMl8O4Cb9_2ChVEenF1FH=s40-c)
Alun Jones [MS MVP]
>FireFox I'm having the exact same problem. I've come to realize that my
>router DI-704P is not translating my internal IP address sent from my FTP
>server (behind the router) to the WAN Public IP. Possibly due to a lack of
>support for ALG??
"ALG" is short for "Application Level Gateway". Your NAT should have
several ALGs, one for every application that it intends to translate the
contents of. In this case, you need an appropriate FTP ALG in your NAT.
>I would also like to use the native FTP server that comes with IIS 6.0.
Why?
>I've read a few post by Alun Jones, he seems to know quite a bit about NAT
>and ALG, I guess he would suggest a better router? I'd still like to know a
>little more before I return this hardware.
If your router is not translating PASV responses or PORT commands, it's a
problem in the router, or its configuration. If DLink can't support you to
get it working, it needs to be returned as not working.
Alun.
~~~~
[Please don't email posters, if a Usenet response is appropriate.]
--
Texas Imperial Software | Find us at http://www.wftpd.com or email
1602 Harvest Moon Place | al...@texis.com.
Cedar Park TX 78613-1419 | WFTPD, WFTPD Pro are Windows FTP servers.
Fax/Voice +1(512)258-9858 | Try our NEW client software, WFTPD Explorer.
Alun Jones [MS MVP]
>Anyway, I have searched for dayz [like I said] I hope to
>find a solution other than the usual reply of
>"PassivePortRange" in the metabase very soon. Otherwise
>this whole IIS 6 venture is a waste of my money!!!
Your router, not your FTP server, is the waste of your money.
see my other post in this thread.
Alun Jones [MS MVP]
>I guess you should check with Linksys support site, from the past
>discussion, our expert - Alun Jones point out that problem using ftp passive
>via NAT, is due to ALG - application layer gateway that supported by NAT
>device. so you need to check if your linksys support that and ensure ftp
>control port is bind to 21.
<blush> Yes - this is something that the NAT _must_ handle. It is wrong
for the FTP server to handle it, because there is one part of the
translation that the FTP server _cannot_ guess correctly.
I've seen FTP servers that try and get around it, by allowing the server
admin to enter the external IP address - that's fine in some cases, but in
many/most situations, the NAT is going to translate the address _and_ the
port. F'rinstance, if two apps are using port 2048 from behind the NAT, the
NAT seemlessly allows them to coexist, by choosing a different port for at
least one of those applications. So, when the server chooses its internal
port number, how will it know if that's the same as its external number?
The only device that knows that information is the NAT, so the NAT must
provide the translation of both the port and the address. Simply splatting
the IP address in as if that's all that mattered will _not_ be reliable, and
may result in port hijacking and data theft.
Alun Jones [MS MVP]
>I see you help a lot of people here! Yes the problem is with NAT. All is
Good - yes, the problem is the NAT, not the FTP server.
>fine if the server is on the public internet. Then when my server tries to
>talk to a client, my server sends out my external IP. When my server is
>behind NAT and a client isn't all is OK also. This is where PASV comes in.
>The problem arises when both are behing a firewall/NAT. Then the client IP
>and the server IP are broadcast with private IP's and everything gets
>confused. In Linux or other windows servers, I can tell the server to
>broadcast only my Outsided IP addy so no one gets confused. In Linux with
>proftpd it is a simple switch/command called MasqueradeIP.
And, as I've mentioned before, this can lead to port hijacking, data theft,
etc. Not secure, not reliable, not good.
>Now, I have gotten all to work if I keep my ftp server on port 21, [with a
>lot of sweat/work] open up ports 20 and 21 And also ports 5000 to 65****.
>[but who wants all those ports open?] Then when I use PassivePortRange in
>the metabase all still seems to work OK at times. If I change from the
>default port of 21 to say 2121 and I want my passive ports to be 2100-2120.
This is because your NAT knows that 21 is FTP, and knows to watch for PASV
responses. Your NAT doesn't know 2121 from 12 (that would be "Adam"), and
hence, doesn't look for PASV responses to change. This is a problem in the
NAT's software, or its configuration. The NAT must do the translation, and
it can only do the translation if it knows what to translate.
>Then all hell breaks loose. MSFTP service is not flexible at all. The only
>way to use it with any flexibility at all is to put it on the public
>internet and I [for one] don't want any MS on the public internet all
>alone!!!!!! If I could make sure all my ftp clients were not behind NAT,
>then all would be well even with this inflexible ftp service With some elbow
>grease.
What's being inflexible here is... yes, your NAT. It assumes that FTP only
happens on port 21, and it doesn't give you any way to say "2121 represents
an FTP connection".
>I understand that IIS is mainly for web serving, but it would be very simple
>for ms to put a little elbow grease into the other features to at least make
>them usable. My gawd, there are millions of posts about pasv behind a
>firewall on the internet and no useless information to get around it, other
>than, "PassivePortRange" which is just minimizing a problem but still making
>you use the port MS wants.
Go search for my name in Google, along with the keywords "PASV" and "NAT".
You should see a _few_ good entries. I answer this one roughly twice a
month.
Bernard
"What's being inflexible here is... yes, your NAT. It assumes that FTP only
happens on port 21, and it doesn't give you any way to say "2121 represents
an FTP connection".
why does NAT behave this way ? why won't they change or let user configure
it ?
If you read other response from Christopher - same thread other branch...
will configuring passiveportrange solve this issue ? I don't think so....
what do you think ?
--
Regards,
Bernard Cheah
http://support.microsoft.com/
Please respond to newsgroups only ...
"Alun Jones [MS MVP]" <al...@texis.com> ????
news:MO5Cb.126$Wf7.26...@newssvr30.news.prodigy.com...
robbieD
Why can so many other [better] servers allow itself to send out a public IP
address rather than the private one on any NAT setup? That is the only
problem [other than not using a default port of 21] It is a simple
undertaking. And if it comes down to security, then I know that is not what
MS is thinking about when a simple Masquerade inquiry comes up at the
meeting table. So, to answer the question, the problem is the FTP server
not being configurable for many landscapes, not NAT!!!
Rob
BTW........go search google for "attitude" and I'll bet your name pops up
there also. Oh Ye Self Proclaimed MS MVP.....
"Alun Jones [MS MVP]" <al...@texis.com> wrote in message
news:MO5Cb.126$Wf7.26...@newssvr30.news.prodigy.com...
robbieD
So what do you suggest? Put something like IIS 6 directly on the internet?
Or are you going to try to tell me that being behind a router isn't safe and
that NAT sucks? Or are you going to try to tell me to use Wftpd? I DON'T
THINK SO ON ALL THREE.
Rob
"Alun Jones [MS MVP]" <al...@texis.com> wrote in message
news:HO5Cb.124$Kf7.26...@newssvr30.news.prodigy.com...
Alun Jones [MS MVP]
>So what do you suggest? Put something like IIS 6 directly on the internet?
No, I suggest bitching at your NAT provider to develop a firmware revision
that allows you to configure the FTP ALG to work on a different port.
>Or are you going to try to tell me that being behind a router isn't safe and
>that NAT sucks? Or are you going to try to tell me to use Wftpd? I DON'T
>THINK SO ON ALL THREE.
WFTPD won't fix this for you either. The fault lies with the NAT, not the
FTP server. The FTP server can only attempt to provide a guess at a
solution that is unreliable and unsecure, so we choose not to do that.
You do need to be behind a firewall or similar, and the NAT is a good
approximation to a firewall - but it's clear that your NAT is not good
enough for your purposes. It may be that there isn't a NAT that can be
configured that way, yet, but it won't change if you don't complain to your
NAT provider.
Alun Jones [MS MVP]
>Why can so many other [better] servers allow itself to send out a public IP
>address rather than the private one on any NAT setup? That is the only
>problem [other than not using a default port of 21] It is a simple
I don't agree that it's better - as I've said before, this leads to port
hijacking, which allows any of your visitors to grab traffic from any of
your other visitors - inbound or outbound data traffic. And port hijacking
won't happen just when a hacker goes after you - it'll happen randomly and
unpredictably. I don't call that "better".
>undertaking. And if it comes down to security, then I know that is not what
>MS is thinking about when a simple Masquerade inquiry comes up at the
>meeting table. So, to answer the question, the problem is the FTP server
>not being configurable for many landscapes, not NAT!!!
The key is that the NAT has _all_ of this information, and should be the
place to implement this functionality. If your NAT doesn't have a
configurable FTP ALG, then it's a crappy NAT. And, yes, I have yet to see a
NAT that isn't crappy. That still isn't a reason to screw up the security
of another component, the FTP server.
It also removes the ability you have to connect to your FTP server
internally. But I doubt that's terribly important.
Alun Jones [MS MVP]
>"What's being inflexible here is... yes, your NAT. It assumes that FTP only
>happens on port 21, and it doesn't give you any way to say "2121 represents
>an FTP connection".
>
>why does NAT behave this way ? why won't they change or let user configure
>it ?
Because they've caught the Microsoft disease - "Everything is web, and we
only give a nod to the other protocols". Any ALG should be configurable to
run on any port, but generally it isn't set up that way by the firmware
writers.
>If you read other response from Christopher - same thread other branch...
>will configuring passiveportrange solve this issue ? I don't think so....
>what do you think ?
I suppose, if you have a static port mapping, but that's a whole lot of
ports to have to open! [Remember, FTP closes and reopens a connection on
each data transfer, so you'd have to have enough ports open to handle four
minutes worth of transfers from any individual host. That's a lot.]
Egbert Nierop (MVP for IIS)
news:Yn1Cb.37107$Ha2....@newssvr29.news.prodigy.com...
>
> Hi Bernard,
>
> I see you help a lot of people here! Yes the problem is with NAT. All is
> fine if the server is on the public internet. Then when my server tries to
> talk to a client, my server sends out my external IP. When my server is
> behind NAT and a client isn't all is OK also. This is where PASV comes in.
> The problem arises when both are behing a firewall/NAT. Then the client IP
> and the server IP are broadcast with private IP's and everything gets
> confused. In Linux or other windows servers, I can tell the server to
> broadcast only my Outsided IP addy so no one gets confused. In Linux with
> proftpd it is a simple switch/command called MasqueradeIP.
>
> Now, I have gotten all to work if I keep my ftp server on port 21, [with a
> lot of sweat/work] open up ports 20 and 21 And also ports 5000 to 65****.
> [but who wants all those ports open?] Then when I use PassivePortRange in
> the metabase all still seems to work OK at times. If I change from the
> default port of 21 to say 2121 and I want my passive ports to be
2100-2120.
> Then all hell breaks loose. MSFTP service is not flexible at all. The only
> way to use it with any flexibility at all is to put it on the public
Second NAT is something else as a firewall.
I advice to you to forward all IP traffic meant for FTP to your server AND
use a firewall. So IIS is not 'open' to all TCP/IP traffic.
--
compatible web farm Session replacement for Asp and Asp.Net
http://www.nieropwebconsult.nl/asp_session_manager.htm
Andrew
short too. As I don't think LinkSys ( or any firewall/router firmware
dev. ) is going to add this feature at my request, I'm forced to scrap IIS
as my ftp server and use something, well, less "secure". I see many ftp
servers written for Windows allow the admin to set the passive mode IP to
something external so PASV mode actually works with both client and server
firewalled. Maybe M$ should coach some of these ftp devs. so they stop
producing such insecure ( yet strangely flexible and functional ) ftp
servers.
Post script:
MVP's... it's best to admit when your product has a shortcoming and
simply put in a feature request with the devs. As it stands you're arguing
with customers. Not Good. I'm sure the code will take 3 hours at most for
a blue badge.
"FireFox" <fire...@charter.net> wrote in message
news:exPMRmHv...@TK2MSFTNGP11.phx.gbl...
> My problem is "blogger" can establish a port 21 ftp control
connection,
> but when it switches to PASV mode my outgoing ip/port for data uses my...
Andrew
Alun Jones [MS MVP]
>I have the same issue with my LinkSys firewall/router. Apparently it falls
>short too. As I don't think LinkSys ( or any firewall/router firmware
>dev. ) is going to add this feature at my request, I'm forced to scrap IIS
>as my ftp server and use something, well, less "secure". I see many ftp
>servers written for Windows allow the admin to set the passive mode IP to
>something external so PASV mode actually works with both client and server
>firewalled. Maybe M$ should coach some of these ftp devs. so they stop
>producing such insecure ( yet strangely flexible and functional ) ftp
>servers.
I hate to tell you this, but the insecurity comes from allowing your FTP
server to put an external IP address in the PASV response, but not allowing
it to know the external port numbers assigned, because the NAT will assign
those dynamically.
So, as a rough idea here - let's say your FTP server is behind a NAT that's
shared with two computers. The computer that isn't your FTP server binds to
a port and gets an incoming connection mapping. Since this is the first
port bound, it gets port 1024 - internal and external. Now the FTP server
wants to do the same, and since this is its first bind, it gets local port
1024, but since it's not the NAT port bind, it gets external port 1025. The
FTP server doesn't know this, and tells the client to connect to external
port 1024 and start the transfer.
That's a security flaw - your FTP server just told your FTP client to go
throw the data down a completely unrelated network connection!
It's not just MS that write their FTP server this way, I do too, and I've
been doing FTP server development and support for the last decade.
>Post script:
> MVP's... it's best to admit when your product has a shortcoming and
>simply put in a feature request with the devs. As it stands you're arguing
>with customers. Not Good. I'm sure the code will take 3 hours at most for
>a blue badge.
As an MVP myself, I can quite definitely reassure you - it ain't "my
product". It's Microsoft's. As you can see, I don't think it's the last
word in FTP servers. It might be a first word, and something that leads
people on to more sophisticated servers like mine.
Bottom line, the bug is in the NAT router. Most NAT routers will modify FTP
traffic acceptably, if the server is on port 21. My Linksys BEFSR41 does
this, my Microsoft MN-500 does this, every other NAT router I've heard of
will handle FTP traffic on port 21. According to one RFC, at least, it's
not a NAT if it doesn't handle FTP traffic properly on port 21.
Go back to Linksys, check if there's a new firmware update, and then ask
their support people how to get FTP working.
Bernard
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/proddocs/standard/ref_reg_ftpservice.asp
Set EnablePortAttack's value to 1, restart IIS Services.
--
Regards,
Bernard Cheah
http://support.microsoft.com/
Please respond to newsgroups only ...
"robbieD" <anon...@nowhere.net> ????
news:Yn1Cb.37107$Ha2....@newssvr29.news.prodigy.com...