FileZilla Server: Implicit SSL part 2

From The Uniform Server Wiki
Jump to navigation Jump to search

MPG UniCenter

MPG UniCenter

Uniform Server 3.5-Apollo
FileZilla Server.

On a local network FTP works just fine however when connecting to the Internet you need to consider a user (FTP client) more importantly the mode of transfer, active or passive. Everything is geared to make it easier for the client hence your server must support passive mode. The following covers this mode and the added complication of running a FTP server behind a wireless router with NAT.

FTP Basics

FTP uses two ports, a 'command' (control) port and 'data' port traditionally these are assigned ports 21 and 20 respectively. Depending on the operating mode, the data port is not always on port 20. Most browsers use passive mode for connection this mode changes the data port as follows.

Top

Passive FTP

In passive mode a client initiates both connections to the server. A client first opens two consecutive random unprivileged ports (ports above 1023). The first port contacts the server on port 21, and issues the “PASV” command. In response the server opens a random unprivileged port and sends the “PORT P” command back to the client. The client then initiates the connection from it’s second port to transfer data.

A secure FTP server follows the above procedure with one minor difference the command port used is reserved port 990.

What’s important when using a NAT device is the need to forward ports 20, 21, 990 and all unprivileged ports. In reality unprivileged ports are restricted to a small range for example 50000 to 50100.

During a data transfer the FTP server needs to send its visible IP address back to a client. Because of address translation through a NAT device the FTP servers has no way of determining this IP address. It needs to be set during FTP server configuration, not a problem if you have a fixed IP address however a dynamic IP is problematic.

The FileZilla team neatly resolves this issue by providing a dynamic IP address resolution service.

Top

Active FTP

If you have ever set-up an FTP client behind a NAT (Network Address Translation) router you will have been forced to changed mode from active to passive. Reason for this, active FTP will not work behind a NAT device.

Top

Summary

The above is intended to explain why you need to twiddle certain settings and how to choose options for your installation. All settings for passive mode are on a single page making the whole set-up process easier.

Top

Configure Passive Mode

  1. Start the server by double clicking on filezila_start.bat
  2. Start the administration interface, double click on filezilla_admin.bat
  3. Select Edit > Settings
  4. A) Select Passive mode settings
  5. B) Default: Select this if directly connected to the Internet.
  6. C) Use the following IP: If connected to the Internet via a NAT router and you have a fixed IP address enter it here.
  7. D) Retrieve external IP address from: If connected to the Internet via a NAT router and you have a dynamic IP address select this radio button. Enables FileZilla’s dynamic IP address resolution service
  8. E) Don’t use external IP for local connection. Default is checked, no need to change this.
  9. F) Use custom port range: Check this box to enable, we do need to restrict the range of random ports. This also restricts (minimises) the ports that require forwarding in the router.
  10. G) Enter range of ports you want to allow, 50000-50100 is reasonable. Allows 100 ports consider reducing this if you do not expect a high number of simultaneous connections.
  11. H) Click OK

Top

Configure NAT Router

You need to forward ports 20, 21, 990 and the range (50000-50100) to your PC’s IP address (192.168.1.6)

Replace the values in brackets with your own.


There is a vast range of routers hence I have not provided any detailed set-up instructions.

Again I point you to PortForwrd a website dedicated to this topic with detailed instructions how to forward ports on most routers.


When setting up your router, example shown on the right hopefully provides a clue what to look for.

Top

Summary

You now have a fully working secure FTP server that will transfer files locally or over the Internet. The FTP server uses absolute paths this is not a problem for a fixed installation however my quest is for a portable solution specifically targeting Uniform Server allowing the transfer of files to and from the Web Server.

Top


Ric