Can not connect to FTP after install of new firewall

Posted on 2007-03-17
Last Modified: 2013-12-06
We installed a new firewal and now can not connect to any FTP sites.  We get an error 255.  

Any ideas?
Question by:mjimison1956
  • 7
  • 4

Author Comment

ID: 18740512
The secure ftp seems to work and within firewall it seems to work.  When we try to run automated scripts that have run for two years with out incident and bring a file in to process from ftp sites we get the following error:  I have put xxxxx in for the ip address for obvious reasons

Processing paused for 60 seconds (Attempt: 3)

  1  ftp> Connected to   2  ftp> OPEN xxxxxxxxxx
  3  Not connected.   4  ftp> USER C0rN3r *******
  5  Not connected.   6  ftp> binary
  7  Not connected.   8  ftp> cd ToTMS
  9  Not connected.   10  ftp> put c:\ecometry\ftproot\TRAVELftp\
  11  Not connected.   12  ftp> put c:\ecometry\ftproot\TRAVELftp\
  13  QUIT

LVL 57

Expert Comment

ID: 18740569
Is the new firewall configured to to allow ftp (port 21) out?

Were you using active or passive FTP for the data connections?  Make sure that the firewall is configured to allow those ports out?

If you have access to the old firewall, you should look at its configuration to see how it handled FTP.

Are you supposed to be doing "secured ftp" to with this ftp server?  If so, is is ssh ftp or ftp ssl?

Author Comment

ID: 18740605
We seem to be able to ftp inside the firewall but nothing from outside where we log in and get or put files.  I am the dba and not an expert on this and of course the network guys say it is the scripts (which have worked for two years until this morning immediately after the firewall know how that is)

I am not sure if active or passive?  Have to find out.  Unless you can tell me a way to check it without the network guys.

It is port 21 for sure.

where would I compare the configuration on old and new or would I not have access to that.  I have root on the unix boxes...  please let me know we are 12 hours behind now on prod processing
Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!


Author Comment

ID: 18740623
From Network guys:

From as best as I can tell, the rules that allow FTP traffic look identical to the ones that were in there before the rebuild.  We are able to connect to SSL Ftp sites, but not unsecured FTP sites.  I’ve left word with Tom to see if he can help walk me through some additional troubleshooting.  I’ll update everyone once I hear back from him
LVL 57

Accepted Solution

giltjr earned 500 total points
ID: 18740661
Most Unix systems today default to passive.  The only way to really tell is to do a ftp and see which command is used, PORT or PASV after the GET/PUT command is issued.  PORT means active FTP and PASV is for passive.

Did the IP address that is seen at the server side change?  If so, the server side could have ACL setup to only allow specific IP addresses in.

Author Comment

ID: 18740695
I see a PORT after doing a put inside the firewall. So active.

IP address did not change.  When you say server side are you talking about our server side where we are running the script to put the file?  If so where would I find this ACL config file?

I know I am fishing here...but got to hook something.

Author Comment

ID: 18740728
This is the result of 'put' from my desktop to one of the unix servers.  Not sure this helps.  Can ftp like that but ftp in from remote server gets the error above in my initial post.

From my pc:

ftp> put script.txt
200 PORT command successful.
150 Opening ASCII mode data connection for script.txt.
226 Transfer complete.
LVL 57

Expert Comment

ID: 18740799
"Server side" in this case is from the ftp point of view.  So in this case you are the ftp client (even though you may be running the script on a "server") and the remote site is the ftp server (even though the ftp server software may be running on a desktop or another server).

PORT means you are active.  If it was passive you would/should see something like:

227 Entering Passive Mode (x,x,x,x,y,y)

You may want to have them check the type of firewall.  Some firewalls will "snoop" on the command/control session and they will see the port being used for the data connection and then dynamically create a rule that allows the data connection to be established.  Some firewalls must have the ftp data ACL's pre defined.

Also, because of the way active ftp works, the data connection is actually initiated from the ftp server.  The ftp server will use source port 20 and connect to the destination port (your side) that is specified in the port command.

What you may want to try is before you issue the put command issue the command "passive".  Hopefully this may put your ftp client in passive mode and it is possible that your firewall may allow this out.  

This does assume that it is the firewall that is causing the problem in the first place.

Author Comment

ID: 18740881
So do we change to ftp pasv in the script?
LVL 57

Expert Comment

ID: 18741546
Yes, anyplace in the script after you have succesfully logged on.  Generally if I need to do passive I do it right before the 1st get/put statment.  You may want to double check that your ftp client supports it before you change the script.

Author Comment

ID: 18743579
perfect solution. thank you.  ever need Oracle help...I am here

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Macbook Sierra OS OpenVPN issue 13 154
Unix Script: Loop over all days of a month 17 116
Install MySQL 5.6 and PHP on Centos Linux 6 159
TLS 1.0 & Windows 7 - How to disable? 16 123
Using libpcap/Jpcap to capture and send packets on Solaris version (10/11) Library used: 1.      Libpcap ( Version 1.2 2.      Jpcap( Version 0.6 Prerequisite: 1.      GCC …
SSL is a very common protocol used these days when browsing the web.  The purpose is to provide security to communication, but how does it do it?  There are several pieces at work that have to be setup before SSL will even work and it requires both …
Learn how to navigate the file tree with the shell. Use pwd to print the current working directory: Use ls to list a directory's contents: Use cd to change to a new directory: Use wildcards instead of typing out long directory names: Use ../ to move…
Viewers will learn how to properly install and use Secure Shell (SSH) to work on projects or homework remotely. Download Secure Shell: Follow basic installation instructions: Open Secure Shell and use "Quick Connect" to enter credentials includi…

749 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question