FileZilla Server2: Implicit SSL part 2
|
FileZilla Server2: Introduction | Portable FileZilla FTPd | Install Options | Basic Config 1 | Basic Config 2 | Implicit SSL part 1 | Implicit SSL part 2 |
| Uniform Server 4.1-Mona FileZilla FTPd (Server). |
On a local network FTP works just fine however when connecting to the Internet you need to consider a user (FTP client) more importantly the mode of transfer, active or passive. Everything is geared to make it easier for the client hence your server must support passive mode. The following covers this mode and the added complication of running a FTP server behind a wireless router with NAT.
FTP Basics
FTP uses two ports, a 'command' (control) port and 'data' port traditionally these are assigned ports 21 and 20 respectively. Depending on the operating mode, the data port is not always on port 20. Most browsers use passive mode for connection this mode changes the data port as follows.
Passive FTP
In passive mode a client initiates both connections to the server. A client first opens two consecutive random unprivileged ports (ports above 1023). The first port contacts the server on port 21, and issues the “PASV” command. In response the server opens a random unprivileged port and sends the “PORT P” command back to the client. The client then initiates the connection from it’s second port to transfer data.
A secure FTP server follows the above procedure with one minor difference the command port used is reserved port 990.
What’s important when using a NAT device is the need to forward ports 20, 21, 990 and all unprivileged ports. In reality unprivileged ports are restricted to a small range for example 50000 to 50100.
During a data transfer the FTP server needs to send its visible IP address back to a client. Because of address translation through a NAT device the FTP servers has no way of determining this IP address. It needs to be set during FTP server configuration, not a problem if you have a fixed IP address however a dynamic IP is problematic.
The FileZilla team neatly resolves this issue by providing a dynamic IP address resolution service.
Active FTP
If you have ever set-up an FTP client behind a NAT (Network Address Translation) router you will have been forced to change mode from active to passive. Reason for this, active FTP will not work behind a NAT device.
Summary
The above is intended to explain why you need to twiddle certain settings and how to choose options for your installation. All settings for passive mode are on a single page making the whole set-up process easier.
Configure Passive Mode
I have assumed the servers are installed for portable operation because of this Uniform Server must be running.
Note: Only portable mode requires this restriction. More specifically it’s the creation of a virtual drive that is required. Neither Apache nor MySQL need to be running.
- Navigate to folder UniServer
- Start UniForm Server – Double click on Server_Start.bat
|
|
Configure NAT Router
|
Ports to forward:
Note 1: Replace the values in brackets with your own specific values.
There is a vast range of routers hence I have not provided any detailed set-up instructions. Again I point you to PortForwrd a website dedicated to this topic with detailed instructions how to forward ports on most routers.
Example shown is for a DrayTek Vigor 2800 |
|
Summary
You now have a fully working secure FTP server that will transfer files locally or over the Internet.
The FTP server uses absolute paths this is not a problem for a fixed installation.
The new plugin resolves absolute paths using a small Perl scripts. This allows both UniServer and FileZilla servers to be run in either portsable or fix mode.
This combination caters for both production and test environments.