Secure FTP on ReadyNAS Pro using FileZilla

Posted on 2011-02-22
Last Modified: 2012-06-21
The Netgear ReadyNAS Pro is set up to run FTP/S using ProFTP 1.3.3 Server and I'm using the latest FileZilla FTP client.  On the LAN, I can connect securely using FTPES (FTP over explicit TSL/SSL) using Port 21.

I opened a port on the SonicWALL to direct incoming WAN Port 21 traffic to the ReadyNAS.  On a laptop that's outside our SonicWALL, I can establish a secure FTPES connection but it can't list the files in the share.  Here's a dump of the FileZilla log:

Status:      Connecting to X.X.X.X:21...
Status:      Connection established, waiting for welcome message...
Response:      220 ProFTPD 1.3.3 Server (NETGEAR ReadyNAS) []
Command:      AUTH TLS
Response:      234 AUTH TLS successful
Status:      Initializing TLS...
Status:      Verifying certificate...
Command:      USER xxxxx
Status:      TLS/SSL connection established.
Response:      331 Password required for xxxxx
Command:      PASS **********
Response:      230 User xxxxx logged in
Command:      SYST
Response:      215 UNIX Type: L8
Command:      FEAT
Response:      211-Features:
Response:       MDTM
Response:       MFMT
Response:       TVFS
Response:       UTF8
Response:       AUTH TLS
Response:       MFF modify;;UNIX.mode;
Response:       MLST modify*;perm*;size*;type*;unique*;*;UNIX.mode*;UNIX.owner*;
Response:       LANG en-US*
Response:       PBSZ
Response:       PROT
Response:       SITE MKDIR
Response:       SITE RMDIR
Response:       SITE UTIME
Response:       SITE SYMLINK
Response:       REST STREAM
Response:       SIZE
Response:      211 End
Command:      OPTS UTF8 ON
Response:      200 UTF8 set to on
Command:      PBSZ 0
Response:      200 PBSZ 0 successful
Command:      PROT P
Response:      200 Protection set to Private
Status:      Connected
Status:      Retrieving directory listing...
Command:      PWD
Response:      257 "/" is the current directory
Command:      TYPE I
Response:      200 Type set to I
Command:      PORT 192,168,9,100,192,110
Response:      500 Illegal PORT command
Command:      PASV
Response:      227 Entering Passive Mode (192,168,0,50,152,88).
Status:      Server sent passive reply with unroutable address. Using server address instead.
Command:      MLSD
Error:      GnuTLS error -53: Error in the push function.

Any ideas?
Question by:Wade_Chestnut
  • 3
  • 2
LVL 33

Accepted Solution

digitap earned 500 total points
ID: 34958039
i can see the log is wanting to move to passive mode which access a non-standard port.  review the links below.  the first is simply setting up the sonicwall for ftp access.  i think you've already done that.  the second discusses passive ftp and how it relates to the sonicwall.
LVL 33

Expert Comment

ID: 34958045
also, review the link below as it has some good discussion on passive ftp relating to the sonicwall.

Author Comment

ID: 34961265
Thanks for the suggestions, digitap.  Unfortunately, we don't have the Enhanced OS so I can't use the suggested steps.  We already have plans on replacing the SonicWALL with a FortiWiFi router in the next month or so.

I did read more on active vs. passive FTP and even tried to set a short (43085-43090), custom passive port range on the ReadyNAS and open those ports on the SonicWALL, but now it won't connect at all -- even when I tried to change the settings back. : \

Author Comment

ID: 34961442
Nevermind!  The darn ReadyNAS's FTP server wasn't running.  It's working now!  Thanks for your guidance!!
LVL 33

Expert Comment

ID: 34962279
hehe...small details :)  thanks for the points!

Featured Post

Announcing the Most Valuable Experts of 2016

MVEs are more concerned with the satisfaction of those they help than with the considerable points they can earn. They are the types of people you feel privileged to call colleagues. Join us in honoring this amazing group of Experts.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Explore the encryption capabilities built into Google Apps and how these features can help you meet privacy policy and regulatory compliance, but are not a full solution. Understand and compare the most popular email encryption services for Google A…
This paper addresses the security of Sennheiser DECT Contact Center and Office (CC&O) headsets. It describes the DECT security chain comprised of “Pairing”, “Per Call Authentication” and “Encryption”, which are all part of the standard DECT protocol.
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…

830 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question