Vsftp passive mode configuration on ec2 instance - amazon-ec2

I'm trying to configure a vsftp server on one of my ec2 instances but when I try to connect via a ftp client in passive mode I receive the error message "Server sent passive reply with unroutable address. Passive mode failed."
I have added to my vsftpd.conf file the following lines
pasv_enable=YES
pasv_min_port=1024
pasv_max_port=1048
port_enable=YES
pasv_address=xxx.xxx.xxx.xxx
and I have configured ports 20,21 and 1024-1048 in my security group.
What am I missing?

I find the solution to the problem...
If the instance has and ipv6 address associated vsftpd(bug? desired behaviour? who knows...) will always return 0.0.0.0 as remote address.
You can avoid this behaviour setting this parameters:
listen=YES
listen_ipv6=NO

Related

FTP server running on Port 2000 over NAT not working on Passive Mode

I am running FILE-Zilla ftp server on windows in one of the LAN pc connect to my router. i am trying to access the FTP server from the network outside of the router using Router WAN ip (WAN-to-LAN) by adding Port-Forwarding rule (NAT) in the router. I have 2 cases here as per below configurations. the 1st is working and the 2nd is not (in Passive mode).
Note: i have added the custom inbound rule in the windows 7 firewall
where the ftp server is running.
Configuration #1
Filezilla FTP server port: 21
Passive port range: 50000-51000
NAT - external port: 21
NAT - internal port: 21
Windows firewall inboud rule port allow port: 21, 50000-51000
Client connecting to: <Wan IP>:21
This is working if client is trying to connect using Active/Passive mode
Configuration #2
Filezilla FTP server port: 2000
Passive port range: 50000-51000
NAT - external port: 21
NAT - internal port: 2000
Windows firewall inboud rule port allow port: 2000, 50000-51000
Client connecting to: <Wan IP>:21
This is working only if client is set to Active mode.
Not working with Passive mode configuration by client. the client can connect and login is successfull but ends with the error message at server side like this without any directory listing.
227 Entering Passive Mode (192,168,1,2,195,85)
Note: both the case working in LAN-LAN network.
My guess is that the configuration #1 works only because the NAT is smart enough to translate the IP address in the PASV response from the server. But it likely does that only for the standard FTP port.
You should tell the FileZilla FTP server its external IP address. Go to Edit > Settings > Passive mode settings > IPv4 specific > External Server IP Address for passive mode transfers.
Currently your FTP server is sending its internal IP address to the client. And the client obviously cannot connect to the IP address.
And have the NAT forward the ports in the passive port range (50000-51000).
Though the change will break the LAN-LAN connections. To allow both LAN and WAN connections, check if the NAT can be configured to translate the IP address for the non standard ports too. Though the translation will work for unencrypted connection only anyway. And you should not use unencrypted connections!
The last option is to use the extended passive mode (EPSV), if your clients allow that. In the extended passive mode, there's no IP address in the response. The FTP client uses the primary IP address of the FTP server for data connections.

Tftpd64 unable to transfer file to client

I am using Tftpd64 as server for transferring file to client.
Now when client request the file then i see below error in log viewer window of Tftpd64.
Connection received from 2a01:7e00:e000:11c:3546:7805:766:7110 on port 61445 [23/06 11:50:44.967]
Read request for file <test.ota>. Mode octet [23/06 11:50:44.967]
OACK: <blksize=1200,timeout=5,> [23/06 11:50:44.967]
Using local port 61801 [23/06 11:50:44.967]
File <test.ota> : error 10054 in system call recv An existing connection was forcibly closed by the remote host. [23/06 11:50:45.131]
Is any one have idea about above error?
Also i disabled the firewall in my PC but still getting same error.
Finally i am able to make Tftpd64 server up and running. I made below changes.
Enabled Windows Firewall.
Create rule for Tftp server (Widnows firewall->Advance settings->Inbound Rules->New Rule) to allow connection and apply rule for domain, public and private.

FTPS | connection closes abruptly after entering passive nide

I would like to connect to an FTP destination and write a file to it.
FTP abruptly closes after entering PASV mode. There is nothing wrong with the FTP server setting as such. I am not really sure what I can fix on the FTP server to fix this problem. Any ideas?
Q: Is the IP address in the client message the same as the servers IP the client accessed or is it the non-public IP address of the server? --- A: It is the non-public IP that the client gets.
This sounds like a FTP server behind a NAT which provides the internal private IP address in the reply for the PASV command. Since the client is probably not in the same private network this private address is not reachable by the client.
Thus the client gets the following error:
"java.net.SocketPermission" "10.xx.xxx.xxx:123456" "connect,resolve"
FTP where one side is behind NAT conflicts with the general architecture of the FTP protocol, that is dynamically created data channels where the endpoints get announced within the control connection. If only one of the peers is behind NAT you can usually work around it by using either passive mode (client behind NAT) or active mode (server behind NAT). If both peers behind NAT or if you want to use passive/active mode in an unsuitable scenario it gets more complicated and you usually need either helpers on the router/firewall or specific configurations for the client/server and lots of ugly port forwarding.

Connection from IIS7 to sql server fails when outbound traffic is blocked

I'm using windows 2008 R2 with IIS 7.5 (default config) trying to configure my firewall to block all outgoing connections, to prevent malicious attacks from "phoning home".
What outgoing rules do I need to create to enable the web application to connect to SQL Server default instance? The SQL server is under my control and it's running port 1433 for sure.
The webserver works fine. But the connect to DB step fails.
When I ping the sql server 2012 from the web server, I get the following:
Pinging xxx.0.0.xxx with 32 bytes of data:
General failure.
General failure.
General failure.
General failure.
I have already tried the following:
Created an outbound rule for port 1433 for w3wp.exe for port 1433
Created an outbound rule for WWWPublishing service for port 1433
When the above failed, I created an outbound rule for ALL programs
and applications for 1433, still no go.
When all failed. I tried to enable ALL the included rules in the
list, still didn't help
Tried connection string with data source=xxx.0.0.xxx and data
source=xxx.0.0.xxx,1433 both worked with outbound allowed, and both faild when outbound is blocked.
Created a new rule to enable RPC, so I created a rule for all TCP
traffic for services.exe
The only way to get it to connect, is to change the default behavior for the firewall to Allow outgoing traffic.
Just to reiterate, the only connection that is failing is web-server-> sql server.
Internet to Web server is fine.
Which port/program am I missing?
1433 is the port your remote machine listens to not the outgoing port of the clients.
Outgoing ports are dynamically assigned by the OS.
Go on a process basis.
An outbound rule All Ports of w3wp to 1433 works.

Is it possible to open a 'local machine only' socket on Windows?

I'm wondering whether or not it's possible to configure a TCP socket such that it cannot accept connections from 'off-machine'.
I want to spin up an HTTP server that should only be accessible from clients running on the same machine, and although I can always filter out 'unauthorized' requests from off-machine, I would prefer it if this local-only behaviour were baked-in.
Also, opening a socket on windows triggers a firewall warning and request for the user to block/unblock the port being opened. I'm hoping that a means exists to avoid this message, if the socket can be configured to only accept local connections.
Bind to loopback interface, ip 127.0.0.1.

Resources