ClearFoundation

I am unable to connect FTP from client. It is showing below mentioned message -

C:\Documents and Settings\administrator>ftp 74.208.31.78
Connected to 74.208.31.78.
Connection closed by remote host.

I have already open the ports for FTP in webconfig (Please check attached screenshots).

Even I have checked IPTABLES entry -

[root@mspphoenix snort]# iptables -L FORWARD
Chain FORWARD (policy DROP)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp dpt:ftp-data
ACCEPT tcp -- anywhere anywhere tcp dpt:ftp


ACCEPT udp -- 192.168.2.0/24 anywhere udp dpt:domain
ACCEPT tcp -- 192.168.2.0/24 anywhere tcp dpt:ftp-data
ACCEPT tcp -- 192.168.2.0/24 anywhere tcp dpt:ftp


I have checked by stopping FIREWALL service. At that time, it is working fine. I think something is there in firewall which is blocking FTP. But I am unable to find it out. I have also tried to check the SNORT. But still unable to find out something helpful.


Any help would be appreciated.

Have you configured your FTP service and client for Active mode? it defaults to passive mode so doesn't use Port 20 (ftp-data), rather data is sent on a port in the range 65000-65100

In addition - are you hosting this FTP server on a PC behind ClearOS or on ClearOS itself? Assuming the latter you will need to add the ports to the Incoming page, not the Forwarding page

See the net for Active vs Passive FTP. I would recommend staying with Passive mode for compatibiilty with other third party firewalls

While using FTP on Local Network, it is working fine. We have not setup any FTP server on clearOS. We are trying to access FTP outside our network.

Rituparna,

Looks like your question was formed incorrectly.
You want to connect to a ftp server on the internet from a ftp client located on a machine behind a clearos box.
Remove the clearos box from the equation and the FTP is working fine for you, right?
And clearos is configured with authenticated proxy.
The squid access logs are not showing anything related to the ftp access attempted.

If this is the scenario, you can try the following next:
Increase debug level in /etc/init.d/squid
Try some tips given herein - nixcraft.com/linux-software/384-ftp-through-squid.html

SB

Sir,

Thanks for your suggestion.

As per your suggestion, I have changed followings on squid -

1. Added the below mentioned line on squid.conf -

acl ftp proto FTP
http_access allow ftp
http_reply_access allow all

2. Increased debug level to 9. After that I got following FTP log from squid -

1301724942.110 3848 192.x.x.x TCP_MISS/401 996 GET ftp://xyz.com/ ab.cd DIRECT/74.208.x.x text/html

I googled with "TCP_MISS/401" and found that its actually authorization problem from FTP server. May be I am wrong also.

After that I have tried to access with "ftp://username:password@xyz.com". It is giving the following message - "you are about to log into the site "xyz.com" with the username "username". After clicking OK, it is prompting me username and password again. I have checked the log again and found the same log message.

Please help.