🔒 Locked

Netgear router modifying FTP packets?

Started by Evil Steve Feb 10, 2009 at 10:16 AM 7 replies 3.5k views

Original Post

Feb 10, 2009 at 10:16 AM

Hi all, Not strictly programming related, but I thought if anyone knows, someone here would [smile] I have Filezilla server set up on my server (An XP 64 machine), with ports 21 and 65000 - 65534 forwarded through my router. Filezilla is set up with PASV mode, and using the external IP from the sourceforge page. I noticed that when a client connects to the FTP server and sends a PASV request, the server replies with a local IP address - as verified through wireshark. I see: "227 Entering Passive Mode (92,235,164,136,253,235)" in the packet capture. However, the client sees something completely different, "Response: 227 Entering Passive Mode (92,235,164,136,196,68)" (Again, verified through wireshark). My router is a WGR614v9. Googling seems to have given me a load of pages about people having problems setting up FTP servers, but nothing specifically related to the router fudging data. Does anyone know if this is definitely a problem with the router, and if there's a way of disabling it? I'll try setting up a dummy FTP server when I get home and see if it has the same problems as Filezilla. EDIT: If I set the server to use port 23 instead of 21, it all works fine. I assume this is a router "feature"... Cheers, Steve

Antheus

Feb 10, 2009 at 12:19 PM

From what I remember, FTP needs ports >1024. And doesn't it use ports 20 and 21?

I haven't used or set up ftp in years, at least not in this way. ssh or sftp tends to be the norm for a while now.

Sneftel

Feb 10, 2009 at 12:30 PM

Under normal circumstances, it's necessary for the router to fudge the data. The response to PASV is "You can connect directly to the data connection on my end at such-and-such an IP and port". Except that the server is wrong about this, because the client won't be able to see the server's local IP address. The NAT server sees the PASV response, and fudges it with the public IP address and a port which it thereupon uses to funnel the data back to the server.

Given that the server seems to somehow be sending out the actual public IP rather than its own IP, I suspect the issue is an FTP server that's a bit too big for its britches and is trying (unsuccessfully) to do the same translation that the NAT server is doing.

Anyways, disabling passive mode should fix your problem.

Evil Steve

Feb 11, 2009 at 3:48 AM

Quote:
Original post by Antheus
From what I remember, FTP needs ports >1024. And doesn't it use ports 20 and 21?

I haven't used or set up ftp in years, at least not in this way. ssh or sftp tends to be the norm for a while now.

Ports > 1024 are generally used for non-root services, and as far as I know aren't reserved. FTP uses two connections, one on port 21 for FTP control commands, and any port range for data. You can use port 20 for data if you like, but it's more common to say "Use this range of ports" and specify a range over 1024.

Quote:
Original post by Sneftel
Under normal circumstances, it's necessary for the router to fudge the data. The response to PASV is "You can connect directly to the data connection on my end at such-and-such an IP and port". Except that the server is wrong about this, because the client won't be able to see the server's local IP address. The NAT server sees the PASV response, and fudges it with the public IP address and a port which it thereupon uses to funnel the data back to the server.

Given that the server seems to somehow be sending out the actual public IP rather than its own IP, I suspect the issue is an FTP server that's a bit too big for its britches and is trying (unsuccessfully) to do the same translation that the NAT server is doing.

Anyways, disabling passive mode should fix your problem.

In the server settings, I can specify the IP address to use for PASV mode. Disabling that and letting the server use it's local IP (192.168.1.200) causes the router to fudge the IP address as well as port.
Given that Wireshark shows the outgoing packets with the correct port number (In the 65000+ range), it can't be the FTP server fudging things and must (I think) be the router.
Disabling passive mode would prevent anyone connecting to the FTP server who is behind the NAT, which is the case for almost all of the users of my server.

Thanks for the replies.

SiS-Shadowman

Feb 13, 2009 at 3:06 AM

Since your server is behind a router as well, I assume it does NAT as well? That would explain why the router changes the ports. The router doesn't want to expose the port used in the local network, it tells the client another port. Now the router should forward any tcp packet coming to the extern port to the internal port in the local network (and of course rewrite the destination ip-address of the ip-header.

Well, that's what the router should do :)

*Edit* One possible reason for the need to rewrite tcp portnumbers is to avoid problems with the internal NAT table of the router. In theory, the port 253*8+235 could be already be located in the NAT table, which would obviously result in packets being delivered to a wrong local address/port. To avoid that, the router rewrites the packet and keeps an entry in the NAT table to forward incoming packets to the right internal address/port. The router will need to modify the payload of the tcp packets as well (for known protocols) to not break them. That's why it changes the ports as well.

[Edited by - SiS-Shadowman on February 13, 2009 5:06:48 AM]

hplus0603

Feb 13, 2009 at 11:23 AM

Certain protocols put IP addresses and port numbers inside the data stream. This doesn't work with NAT. Thus, protocol re-write was born, where the NAT machine understands certain protocols, and re-writes the protocol while it re-writes the return address. FTP is the classic example of where this happens, but there are other protocols, too. For more information, check out mod_rewrite for Linux, for example.

Evil Steve

Feb 13, 2009 at 11:26 AM

I see. So is there a way to disable this? The router is breaking the FTP server, if it wasn't modifying the FTP commands, then it would all work fine...

EDIT: I've submitted a support request to Netgear now, I probably should have done that in the first place...

[Edited by - Evil Steve on February 13, 2009 12:26:22 PM]

hplus0603

Feb 13, 2009 at 10:43 PM

Most routers have some configuration that lets you set whether they do re-write or not, although they may call it something else (like "service enabling" or something).
If yours doesn't, then trying to go through customer support is the only other option. Or replacing the firewall with something real, like a box running Linux w/iptables :-)

Evil Steve

Feb 15, 2009 at 7:29 AM

Quote:
Original post by hplus0603
Most routers have some configuration that lets you set whether they do re-write or not, although they may call it something else (like "service enabling" or something).
If yours doesn't, then trying to go through customer support is the only other option. Or replacing the firewall with something real, like a box running Linux w/iptables :-)

Yeah, I couldn't see any option for it. I did a full reset of the router, and it seems to be working all fine now. I probably should have tried that earlier [smile]

I did have this PC running RedHat 8 for a while, but I got fed up with it and switched to XP 64 (Which was a bad choice :P)

Thanks for all the replies.

Topic Locked

This topic has been locked by a moderator. New replies are not allowed.