FTP can connect but won't list files nor put new ones

[O. Jadot]

Greetings all.

I'm stuck using FTP.

My FTP server is an OpenVMS Cluster build on 2 AS1200 running OVMS8.2. Each of these has 2 ethernet cards, first card of alphas on a LAN (10.2.1.158 and 159), second card on another(10.2.2.158 and 159).
A cluster IP is set on the 10.2.2 card, and is 10.2.2.160.
IP version is 5.5, all and every patchs are applied.

Accessing my cluster with FTP connections is alright if i'm within my LANs : I can FTP 10.2.1.158 or 159 for the first card of each server, and I can ftp 10.2.2.158 or 159 for the second card of each server. The same way, I can FTP 10.2.2.160 for the cluster IP. Once logged in, I perfectly have access to all FTP features.

10.2.2.160, my cluster address, is translated so it can be accessed from outside, especially from our customers. Translation is 193.xxx.xxx.xxx.

While calling 193.xxx.xxx.xxx from anywhere, I do connect to my cluster, which asks for username/password, and then grants access.

But at this point begins trouble. I cannot see what's in my directory, nor can I put new files in it.

Message returned on a command is such :

ftp> dir
200 PORT command successful.
425-Can't build data connection for 194.133.xxx.xxx,53772
425 connect to network object rejected
ftp>

194.133.xxx.xxx is a perfectly unknow address, but is always the same.

Thanks for your time and answers.

OJ

[Karl Rohwedder]

It may have tp do with active/passive mode. Habe you tried SET PASSIV ON (or whatever the command on your FTP application is).

regards Kalle

[Thomas Ritter]

ftp> dir
200 PORT command successful.
425-Can't build data connection for 194.133.xxx.xxx,53772
425 connect to network object rejected
ftp>

The can't build data connection is the big clue. FTP is using port 20 to build a reverse connection to the requesting host. This is the next clue. To which host is port 20 being connected ? Set up TCPTRACE and study where the connections are being made. Also make sure the routing is working the way you expect it.
Now when firewall are involved you need to have it very clear how the connections are being established and then ensure the firewall policy allows the access.

[Steven Schweda]

> 10.2.2.160, my cluster address, is
> translated so it can be accessed from
> outside, especially from our customers.
> Translation is 193.xxx.xxx.xxx.

Is that _address_ translated, or only selected
_ports_ at that address? Non-passive FTP
uses two ports: 20 (data) and 21 (control).

"Can't build data connection" makes me
suspect port 20.

"Telnet /port = 20 ftp_server" (or
equivalent) from the outside world should
get a "SYSTEM-F-REJECT" (or "connection
refused") from the FTP server, but it should
_not_ be blocked (or lost).

[O. Jadot]

Your ideas helped.

Port 20 wasn't translated, thus opening it didn't break troubles.

We changed our big router, the one that selects wich ports are translated, which lan goes where, and who cooks the coffee, for another one that has less options.

And it worked.

So now, we'll get back to the router's editor to have answers on what happened.


Thanks a lot for your help !

OJ