Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[mas110]

Hi

I am new to the home networking and obviously not an expert.  I read all the threads in this forum and whatever I could find in a Google search.  Clearly, I could not understand some or most of the high tech stuff such as Telnet and so on.  However, based on what I learned, I could finally set up my Linksys router and D-Link DNS-323 to work at home. The home network is fine and the media sever is working OK.  The FTP is also working perfectly at home from internal computer.  However, from outside, I only can access the FTP by using a web based FTP client such as net2ftp.com.  Regular, FTP clients does not work. I tried  IE8, Mozilla FireFox, and WinSCP.  I also turned off (or unchecked) the passive mode.  I tried it with and without SSL.  Nothing worked except web base clients.  I greatly appreciate if anybody can provide a hint about the source of this problem.    By the way, the port of FTP server in DNS-323 configuration is not Port 21.  I set it on a port higher than 1900 and forward that port in my router to DNS static IP address.  I thought using a non typical port is safer (just a feeling).   I am not sure if the port is the source of the problem as it does work with net2ftp.

Thank you in advance for your help.

Regards,

Mas110

[gunrunnerjohn]

FWIW, I've had the basic FTP working using port 21 externally and locally on my network.  That should work pretty much out of the box.  I have yet to get secure FTP working externally.

[mas110]

Thanks gunrunnerjohn

I will change the port to 21 tonight and test tomorrow when getting back to the office.  I have not seen any parameters in the web base configuration page for secure FTP.  What do you mean by "I have yet to get secure FTP working externally"?

[gunrunnerjohn]

If you're running the latest beta, it has an option for secure FTP.

[mas110]

Got it. Thanks.  I think this is the answer to my other question in another thread (Beta version).  Not sure.  Anyway, As I noted here I can use my FTP with www.net2ftp.com, even with another base port (beside 21).  In the net2ftp, once I marked the SSL option and it also worked.  It may mean that the secure communication is working.  I noted that in release notes of Firmwire ver 1.06 or ver 1.05, it is stated that the FTP with SSL is added.  May be the typical FTP access can be secured with SSL.  I have not seen the beta and not that expert.  Hopefully, there are more security options in the 1.08 version.
thanks for your time.

[gunrunnerjohn]

I can get secure ftp working on my local network, but for some reason it refuses to function from the Internet side.

[mas110]

I beleive you are refering ot Passive FTP (if I understand correctly).  What about just SSL.  Does it work for you?  As noted. it worked for me with the web base client.  However, nothings work for me with typical clients.  I am going to change the port to 21 and try it tonight.

[gunrunnerjohn]

I'm trying to get FTP over SSL/TLS working.  Works fine locally, just won't work through the router.

[fordem]

mas110

Because you are not using port 21 - there is a high probability that the NAT firewall at the client end of things does not recognize the incoming data connection as "belonging" to the already established control connection and is discarding it.

Your options are to ...

a - Switch to port 21 - most consumer NAT routers know to "fixup" the ftp protocol when they see the outgoing connection on 21

b - Either connect the ftp client directly to the internet, or place it in the DMZ of the NAT router so that incoming data connection is not discarded

c - Use passive ftp.

[mas110]

Thanks for the reply.  Here is what I understand:

Option a (Port 21): I beleive there is lower security as other say.  However, I have seen a post from you that you do not beleive port 21 compermise security.  I can not wrap my head around it.

Option b (direct conection of DNS to internet).  In this case, there would be no firewall of the router.  The security should be zero in this case.

Option c (passive): I have to install the Beta version and work my way through it.

[fordem]

Option b is a direct connection of the ftp CLIENT to the internet, not the DNS-323 - the failure occurs because the data connection is made from the server to the client and the NAT router on the client side discards the connection.

With regard the lower security if port 21 is used - perhaps you'd like to explain why you feel there is reduced security.

[mas110]

Thanks for explanation of Option b.  I can understand it better now. Obviously, this option is not feasible everywhere such as work place that I do not have control over router firewall.   In respect to explanation of using Port 21.  My explanation should not worth much as I am not an expert.  The only reason I can find is that when you use a known port, a hacker already knows where to start.  By using a unconventional port, he/she has to figure out what port is for initial connection.  I could be wrong.  it is just a simple way of looking at it.
Regards,
Mas110