FTP won't work in a Ubuntu CT

[N!nja]

Hello everybody,

I currently have the problem that I cannot log into my Ubuntu container via ftp. I have the FTP macro active in the firewall, but filezilla cannot open any directories ... If the PVE firewall for the container is completely switched off, it works without problems ...

Can someone explain or solve this (quick and dirty)?

 

[spirit]

maybe try to load the ftp conntrack helper:

"modprobe nf_conntrack_ftp" in your proxmox host


to have it loaded on boot, add

/etc/modules-load.d/nf_conntrack.conf

nf_conntrack
nf_conntrack_ipv4
nf_conntrack_ipv6
nf_conntrack_ftp

 

[N!nja]

hello and thank you for your feedback. Unfortunately, that didn't really help either.

I tried to sniff the ports used, and I saw that a lot of traffic is used via ports in the range of 49xxx etc, so I enabled ports 40000 to 59999 in the PVE firewall (for testing). Even then it didn't work ...

Ultimately, the container should store various images from my surveillance cameras. Therefore it is not an option to turn off the firewall for the container

 

[spirit]

do you use passive or active mode ?

can you already connect to the server, but it's blocking on "data .." ftp command ?

 

[N!nja]

OK... the solution was so simple.
Idk that I could force the server to use certain ports

/etc/vsftpd.conf

pasv_enable=Yes
pasv_max_port=10100
pasv_min_port=10090

And then open this ports in the FW

 

[spirit]

OK... the solution was so simple.
Idk that I could force the server to use certain ports

/etc/vsftpd.conf

pasv_enable=Yes
pasv_max_port=10100
pasv_min_port=10090

And then open this ports in the FW

yes. (but with conntrack module, you should be able to only open 21, this is strange that it's not working).
The ftp conntrack helper is listening in ftp command channel when the server respond to client with the random port list, and then after at data channel, auto open dynamic ports.

 

[N!nja]

yes, but how does the Conntrack_module on the PVE and the FTP server on the guest work together?
I didn't quite understand that, so it's difficult for me to find the fault.

EDIT: this is the log from FileZilla

Status: Resolving the IP address for NAME
Status: Connect with IP:21 ...
Status: connection established, waiting for welcome message ...
Status: Insecure server; it does not support FTP over TLS.
Status: Registered
Status: Receiving directory content ...
Command: PWD
Answer: 257 "/ home / camera" is the current directory
Command: TYPE I
Answer: 200 Switching to Binary mode.
Command: PASV
Answer: 227 Entering Passive Mode.
Command: LIST
Error: Connection timed out after 20 seconds of inactivity
Error: Directory contents could not be received
Status: Connection to the server disconnected
Status: Resolving the IP address for openhab
Status: Connect with IP:21 ...
Status: connection established, waiting for welcome message ...
Status: Insecure server; it does not support FTP over TLS.
Status: Registered
Status: Receiving directory content ...
....