Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 24 replies
  • Subscribers 8 subscribers
  • Views 40596 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Using Explicit FTP over TLS

Owen

I have spent quite some time searching for a solution to this issue, but alas, I have not found one.
What I want to do seems like it should be a simple task, but I am having no success in getting it to work.

I am using Filezilla as a FTP client behind my Sophos UTM (v9.409-9 - home license) to connect to external FTP servers (for management of external websites).

When I try to use "Use explicit FTP over TLS if available" as my encryption option it authenticates to the FTP server but fails to do a directory listing.

Status:    Connection established, waiting for welcome message...
Status:    Initializing TLS...
Status:    Verifying certificate...
Status:    TLS connection established.
Status:    Logged in
Status:    Retrieving directory listing...
Command:    PWD
Response:    257 "/" is your current location
Command:    TYPE I
Response:    200 TYPE is now 8-bit binary
Command:    PASV
Response:    227 Entering Passive Mode (98,142,97,58,165,21)
Command:    MLSD
Error:    Connection timed out after 20 seconds of inactivity
Error:    Failed to retrieve directory listing

If I use "Only use plain FTP (insecure)" as my encryption option everything works fine, but that is not the way I would prefer to connect to the FTP servers.

I have viewed the firewall log while trying to connect using Explicit FTP over TLS, but I see absolutely no indication of this in the live log.
Surely I am not the only person that has this issue.

 

So... my question is a simple one.
How do I configure the UTM to allow me to use Explicit FTP over TLS to connect to an external FTP server when using Filezilla?

 



This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to Owen

    No, it is here to help with the extra port that ftp uses. I ti s not actually a proxy, but a session helper to ensure that the ftp control port is associated with an active ftp session.

    XG115W - v20.0.2 MR-2 - Home

    XG on VM 8 - v21 GA

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk

    I have looked, but have not been able to find a FTP Helper option.
    Where is that option located?

  • 0 in reply to Owen

    firewall -> advanced.

    there are a number of similar features on that page.

    XG115W - v20.0.2 MR-2 - Home

    XG on VM 8 - v21 GA

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk

    Yes, the FTP connection tracking helper was enabled. I am guessing that this is the default state, as I cannot remember ever setting that option.

    So... that is not the issue. Any other suggestions?

  • 0 in reply to Owen

    What is your outbound rule? You should see all connections in the firewall log.

    I suspect that the issue is really that you have the web proxy enabled in transparent mode so all traffic will be picked up by the web proxy.

    Try adding an exclusion for the site your are going to in the web proxy exclusion list.

    XG115W - v20.0.2 MR-2 - Home

    XG on VM 8 - v21 GA

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk

    I added the IP address of the host FTP sever to Skip Transparent Mode Destination Hosts/Nets, but again, this made no difference.

    I cannot believe that something as basic as using a secure FTP connection is so painful to configure on the UTM. What a PITA!

  • 0 in reply to Owen

    Can you see the traffic in either of the firewall logs or the web filter log?

    XG115W - v20.0.2 MR-2 - Home

    XG on VM 8 - v21 GA

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk

    When I look at the firewall log all I see is the accepted packet on port 21
    There are no entries at all in the web filter log for the FTP server IP address.

    2016:12:30-09:07:19 firewall ulogd[4557]: id="2002" severity="info" sys="SecureNet" sub="packetfilter" name="Packet accepted" action="accept" fwrule="9" initf="eth0" outitf="ppp0" srcmac="a0:a8:cd:xx:xx:xx" dstmac="78:e3:b5:xx:xx:xx" srcip="172.16.xxx.xxx" dstip="98.142.xxx.xxx" proto="6" length="52" tos="0x00" prec="0x00" ttl="127" srcport="59406" dstport="21" tcpflags="SYN"

     

    Connecting to the FTP sever works just fine when I use the non secure connection option, but when I use any of the TLS connection options I cannot get a directory listing.

    As I said... I cannot believe that no one else has this issue, or a simple solution for how to make it work.

  • 0 in reply to Owen

    Hi BigO,

    Time for a pcap. Do a packetcapture and show us the logs. I want to see who sends the RESET.

    Thanks

    Sachin Gurung
    Team Lead | Sophos Technical Support
    Knowledge Base  |  @SophosSupport  |  Video tutorials
    Remember to like a post.  If a post (on a question thread) solves your question use the 'This helped me' link.

  • 0 in reply to sachingurung

    Thanks for the suggestion, but I am in no way a Linux command line person, which is what I believe is necessary to do a packet capture.

    I am guessing that I will just have to accept the fact that I will only be able to do insecure connections to the FTP servers, as I do not have the time or motivation to waste any more time trying to resolve this issue.

    As I have said before... surely it cannot just be me that wants to use a TLS connection to FTP servers and cannot do this from behind the UTM.

Unfiltered HTML