FileZilla Server2: Implicit SSL part 2

Uniform Server 4.1-Mona FileZilla FTPd (Server).

On a local network FTP works just fine however when connecting to the Internet you need to consider a user (FTP client) more importantly the mode of transfer, active or passive. Everything is geared to make it easier for the client hence your server must support passive mode. The following covers this mode and the added complication of running a FTP server behind a wireless router with NAT.

FTP Basics

FTP uses two ports, a 'command' (control) port and 'data' port traditionally these are assigned ports 21 and 20 respectively. Depending on the operating mode, the data port is not always on port 20. Most browsers use passive mode for connection this mode changes the data port as follows.

Top

Passive FTP

In passive mode a client initiates both connections to the server. A client first opens two consecutive random unprivileged ports (ports above 1023). The first port contacts the server on port 21, and issues the “PASV” command. In response the server opens a random unprivileged port and sends the “PORT P” command back to the client. The client then initiates the connection from it’s second port to transfer data.

A secure FTP server follows the above procedure with one minor difference the command port used is reserved port 990.

What’s important when using a NAT device is the need to forward ports 20, 21, 990 and all unprivileged ports. In reality unprivileged ports are restricted to a small range for example 50000 to 50100.

During a data transfer the FTP server needs to send its visible IP address back to a client. Because of address translation through a NAT device the FTP servers has no way of determining this IP address. It needs to be set during FTP server configuration, not a problem if you have a fixed IP address however a dynamic IP is problematic.

The FileZilla team neatly resolves this issue by providing a dynamic IP address resolution service.

Top

Active FTP

If you have ever set-up an FTP client behind a NAT (Network Address Translation) router you will have been forced to change mode from active to passive. Reason for this, active FTP will not work behind a NAT device.

Top

Summary

The above is intended to explain why you need to twiddle certain settings and how to choose options for your installation. All settings for passive mode are on a single page making the whole set-up process easier.

Top

Configure Passive Mode

I have assumed the servers are installed for portable operation because of this Uniform Server must be running.

Note: Only portable mode requires this restriction. More specifically it’s the creation of a virtual drive that is required. Neither Apache nor MySQL need to be running.

• Navigate to folder UniServer
• Start UniForm Server – Double click on Server_Start.bat

Start FileZilla server by double clicking on fz_start.bat Start FileZilla administration interface, double click on fz_admin.bat Select Edit > Settings A) Select Passive mode settings B) Default: Select this if directly connected to the Internet. C) Use the following IP: If connected to the Internet via a NAT router and you have a fixed IP address enter it here. D) Retrieve external IP address from: If connected to the Internet via a NAT router and you have a dynamic IP address select this radio button. Enables FileZilla’s dynamic IP address resolution service E) Don’t use external IP for local connection. Default is checked, no need to change this. F) Use custom port range: Check this box to enable, we do need to restrict the range of random ports. This also restricts (minimises) the ports that require forwarding in the router. G) Enter range of ports you want to allow, 50000-50100 is reasonable. Allows 100 ports consider reducing this if you do not expect a high number of simultaneous connections. H) Click OK

Top

Configure NAT Router

Ports to forward: You need to forward ports 20, 21, 990 And port range (50000-50100) To your PC’s IP address e.g (192.168.1.6) Note 1: Replace the values in brackets with your own specific values. Note 2: There is a vast range of routers hence I have not provided any detailed set-up instructions. Again I point you to PortForwrd a website dedicated to this topic with detailed instructions how to forward ports on most routers. Note 3: When you set-up your router the example shown on the right provides a reference to what you should be loking for. Example shown is for a DrayTek Vigor 2800

Top

Summary

You now have a fully working secure FTP server that will transfer files locally or over the Internet.

The FTP server uses absolute paths this is not a problem for a fixed installation.

The new plugin resolves absolute paths using a small Perl scripts. This allows both UniServer and FileZilla servers to be run in either portsable or fix mode.

This combination caters for both production and test environments.

Top

---