Forum Moderators: phranque
although wu-ftpd works fine for me with my usb adsl modem, when i connect to our redhat server from the office. our chief designer works from behind a nat router and gets the following problem:
he can connect, but after a short period of time and /or when changing directories or uploading and downloading it always times out.
any suggestions? do i need some sort of addition to the ftpaccess file?
many thanks
the moment he starts to navigate or up or download, it times out.
Here is a transcript from a typical connection through cute FTP pro (user name and IP edited edited out). In this case he did not even get a directory listing.
It seems to be the new data socket which is not being received (or sent)?
STATUS:> Getting listing "/htdocs"...
STATUS:> Connecting to ftp server 62.73.123.123:21 (ip = 62.73.123.123)...
STATUS:> Socket connected. Waiting for welcome message...
220 ServerName FTP server (Version wu-2.6.1-20) ready.
STATUS:> Connected. Authenticating...
COMMAND:> USER (**edited**)
331 Password required for (**edited**).
COMMAND:> PASS *****
230 User (**edited**) logged in. Access restrictions apply.
STATUS:> Login successful.
COMMAND:> PWD
257 "/" is current directory.
STATUS:> Home directory: /
COMMAND:> FEAT
500 'FEAT': command not understood.
STATUS:> This site doesn't support the 'features' command.
COMMAND:> REST 100
350 Restarting at 100. Send STORE or RETRIEVE to initiate transfer.
STATUS:> This site can resume broken downloads.
COMMAND:> REST 0
350 Restarting at 0. Send STORE or RETRIEVE to initiate transfer.
COMMAND:> CWD /htdocs
250 CWD command successful.
STATUS:> PWD skipped. Current dir: "/htdocs".
COMMAND:> PASV
227 Entering Passive Mode (62,73,123,123,80,3)
COMMAND:> LIST
STATUS:> Connecting ftp data socket 62.73.123.123:20483...
150 Opening ASCII mode data connection for directory listing.
ERROR:> Timeout (60000 ms) occurred on receiving server response.
STATUS:> This site can resume broken downloads.
they are two different boxes. the old server was a cobalt raq4 with pro-ftp installed. the new server is redhat 7.2 with wu-ftpd 2.6.1 installed.
no settings have been changed on his nat. he could upload perfectly to the old raq4 with pro-ftp. on the new one, it gets the above response.
we have been investigating and there evidently are problems with version 2.6.1 and firewalls / nats. we just haven't found solution yet.
cheers
p.s. upgrading to 2.6.2 might be the solution - but there is no rpm package yet, so it would be a compile job (i am a linux relative newbie and have not yet compiled ;-) *groan*
Still, my bet would be the dns problem.
wu-ftpd and tcp wrappers you might use do reverse dns lookups to prevent spoofing. If your designer's authoritative dns does not respond correctlly - that might be the problem.
You can also disable lookups in tcp wrappers and in wu-ftpd, but that's just one bad idea.
well out with wu-ftpd and in with proftpd (which allowed connections from the nat on the last server we had - a cobalt raq4)
proftpd now works perfectly.... except
he still hangs when requesting a directory listing. it has to do with his nat masquerading his ip - but all i can find in the net (and believe me i've searched ;-) is config for proftpd behind a nat - NOT a client behind a nat.
we are both at our wits ends. anyway thanks for support, maybe another redhat guru is reading.
regards
bcc1234: Make sure he is in passive mode
Did you check this?
Jim
yes. there is nothing funny in the proftpd.conf file either. just standard stuff.
and it works fine for other users - just the ones behind a nat don't work.
we've also tried from other nat computers and failed, so it's not specific to him.
The way ftp works - it has one command connection and multiple data connections.
The command connection is on port 21, the data connections are opened and closed on other ports as needed.
The directory listing is transferred over data connection, but login info isn't.
So if you can login, but not list the files - you got a problem with opening data connections.
Most common problems with nats/firewalls/dns are:
- a firewall might block random ports which the server (or the client) picks for transferring data
- a client behind nat picks ip and port for a connection (in active mode), and since it's behind nat - that ip does not make sense for the server; thus, use passive mode and let server pick connection info
- a server does reverse dns lookups on each connection to prvent spoofing, and if your client's auth dns does not respond or is slow - you would see delays or timeouts
I just described you 90% of problems that occur with ftp. Chances are your problem is in there so double check your set-up.
this is what he has replied ;-)
Yeah believe me I've checked my set-up. why don't I have any problems with any other server? This must indicate that my router is alowing FTP connections and socket changes to other servers?
anyway, lo and behold, suddenly today it works! would you believe it. the only thing i have done to the server is to reboot. nothing else... sounds more reminiscent of a windows solution ;-)
anyway we are really relieved! thanks loads for all the support.
I have always had all filters disabled on the router.
Because I have no problems with any other server this must mean the my config is ok. no?
anyway thanks for your help....I'm getting a new router next week so I'll see what happens then.
Pete
Log into your box and do a revense dns lookup for the ips of the client machines you are having problems with.
After that, do a forward lookup for the hostnames you'll get.
If everythin works fine - then start worrying about routers and other stuff.
[focifum.com...]
"butter" is me
172.26.0.1 is my router (3com 812) with all filters off
80.36.221.10 is my public address which doen't appear on the trace?
Thanks again for all your help.
Peter
Hi, have you realised that I am a networking dummy yet? how do i do a reversed dns lookup? the other thing maybe to note is that telefonica are using a proxy as you can maybe see in this trace i did. but i still am not having problems with any other servers.
Hi bcc1234
Peter had no problems connecting to one of my FTP servers running RH 7.3 with ProFTPD 1.2.6
The problem appears to be specific to Jamie's RH 7.2 box. I have a couple of ideas where the problem may lie and will try to sort it out for him.
Cause wu-ftpd does have more problems with DNS.
It seems to be something with this particular server? I don't have any more clues.....I'm baffled,
Peter.
oh here's a quite a long session I had before timed out.
ProFTPD 1.2.7 Server (Ibiza Spotlight) [62.73.174.58]
STATUS:> Connected. Authenticating...
COMMAND:>USER (changed)
331 Password required for (changed).
COMMAND:>PASS *****
230 User (changed) logged in.
STATUS:> Login successful.
COMMAND:>PWD
257 "/" is current directory.
STATUS:> Home directory: /
STATUS:> This site doesn't support the 'features' command.
STATUS:> This site can resume broken downloads.
COMMAND:>REST 0
350 Restarting at 0. Send STORE or RETRIEVE to initiate transfer
COMMAND:>CWD /htdocs
250 CWD command successful.
STATUS:> PWD skipped. Current dir: "/htdocs".
COMMAND:>PASV
227 Entering Passive Mode (62,73,174,58,227,63).
STATUS:> Connecting ftp data socket 62.73.174.58:58175...
COMMAND:>LIST
150 Opening ASCII mode data connection for file list
226 Transfer complete.
STATUS:> Transfer complete.
STATUS:> Getting listing "/htdocs/night"...
COMMAND:>CWD /htdocs/night
250 CWD command successful.
STATUS:> PWD skipped. Current dir: "/htdocs/night".
COMMAND:>PASV
227 Entering Passive Mode (62,73,174,58,227,64).
STATUS:> Connecting ftp data socket 62.73.174.58:58176...
COMMAND:>LIST
150 Opening ASCII mode data connection for file list
226 Transfer complete.
STATUS:> Transfer complete.
STATUS:> Getting listing "/htdocs/aquarium"...
COMMAND:>CWD /htdocs/aquarium
250 CWD command successful.
STATUS:> PWD skipped. Current dir: "/htdocs/aquarium".
COMMAND:>PASV
227 Entering Passive Mode (62,73,174,58,227,65).
STATUS:> Connecting ftp data socket 62.73.174.58:58177...
COMMAND:>LIST
150 Opening ASCII mode data connection for file list
226 Transfer complete.
STATUS:> Transfer complete.
STATUS:> Getting listing "/htdocs/balansat"...
COMMAND:>CWD /htdocs/balansat
250 CWD command successful.
STATUS:> PWD skipped. Current dir: "/htdocs/balansat".
COMMAND:>PASV
227 Entering Passive Mode (62,73,174,58,227,66).
STATUS:> Connecting ftp data socket 62.73.174.58:58178...
COMMAND:>LIST
150 Opening ASCII mode data connection for file list
ERROR:> Timeout (60000 ms) occurred on receiving server response.
Try hiring somebody on elance to check your server and client.
