ftp times out

[Glowsome]

Since i have upgraded to v5.x (pve-manager/5.1-41/0b958203 (running kernel: 4.13.13-4-pve) it seems i can no longer ftp into a guest.

details:
- Firewall for the Guest system allows FTP (macro)
- Host has module nf_conntrack_ftp loaded -> nf_conntrack_ftp 20480 0 - Live 0xffffffffc0395000

Tested :
- disabling firewall on the Guest -> no change
- added nf_conntrack_ftp to guest -> no change

As far as docs are concerned i have honored all configuration(s) , and can confirm it was working on v4.x so what am i missing, or what has changed ?

- Michael

 

[LnxBil]

Please check if the conntrack helpers are activated with sysctl

net.netfilter.nf_conntrack_helper=1

 

[Glowsome]

Please check if the conntrack helpers are activated with sysctl

net.netfilter.nf_conntrack_helper=1

The value it returned was 0 with

 sysctl -n net.netfilter.nf_conntrack_helper

So i enabled it with

sysctl -w net.netfilter.nf_conntrack_helper=1

retested, still no difference in behaviour

 

[LnxBil]

I think you have to get your hands dirty and start to debug via tcpdump/tshark/wireshark to analyse if this is an active/passive problem.

 

[Glowsome]

I think you have to get your hands dirty and start to debug via tcpdump/tshark/wireshark to analyse if this is an active/passive problem.

Well i have now tested it from like ~10 different hosts/ips/different isp's/setups in trying to reach the guest with ftp, on all i seem to be having the same problem.
So this seems to rule out an issue with me as source/setup/single FW problem/etc... as my knowledge of this all has already put me in a tasking position i'll need a littel help in how to 'get my hands dirty' as you describe

 

[LnxBil]

FTP is two-port protocol with a command and data channel, so a lot can go wrong. Have you tried to use passive FTP?

To debug FTP via tshark/wireshark, please have a look at these:

* * http://www.lovemytool.com/blog/2013...-errors-with-wireshark-by-tony-fortunato.html

 

[Glowsome]

FTP is two-port protocol with a command and data channel, so a lot can go wrong. Have you tried to use passive FTP?

Yes, have tried passive (as that is the default behavour of most ftp-clients, and those are giving the issue.

 

[Glowsome]

[RESOLVED]
I have found my problem, it was usage of an FTP- client which implemented a default behaviour of TLS when connecting.
As nf_conntrack_ftp cannot detect/see the encrypted traffic additional configuration was needed.
in my case : http://forum.directadmin.com/showthread.php?t=50759 gave the exact match on the subject, after the sugested configuration enhancements it was solved.