Plain FTP data connections fail behind a firewall that rewrites PASV

The symptom

FTPS and FTPES sessions (the encrypted variants) work perfectly, but plain FTP sessions are dropped every time the client opens a data connection to transfer a file or list a directory. Logging in works; the transfer does not.

The cause

Most firewalls do NAT, and many can inspect a protocol when the connection is not encrypted. SSH and SFTP are always encrypted; FTP may or may not be. In theory, protocol inspection should only prevent protocol level attacks, not modify what the client asks or what the server answers. In practice, some firewalls (a SonicWall, in the case that led to this article) rewrite the server's reply to the PASV command, replacing the IP address and port the server advertised for the next data connection with their own. They can only do it on plain FTP, because on FTPS and FTPES they cannot read the control channel, which is why the encrypted variants keep working.

Syncplify Server!, like most FTP servers, lets the administrator configure the public address to advertise in PASV replies when the server sits behind NAT: on the FTP page of the Admin UI, under Passive mode addressing, the settings External PASV IP and External PASV IP (TLS), with PASV local networks for the clients that must receive the internal address instead. When the firewall rewrites that reply and routes the data connection elsewhere, the server sees a data connection that does not match what it advertised, and refuses it as tampered or spoofed, which is the correct thing to do.

The fix

If your firewall behaves this way (more like a reverse proxy than a firewall), clearing the External PASV IP in Syncplify Server! may fix the issue, as it did in the case above: the firewall then rewrites a private address into the public one, and the data connection lands where the server expects it.

Keep in mind that the setting exists for a reason. If your firewall is transparent, that is, it forwards the PASV reply as it is, you need the external address there when the server is behind NAT, or clients receive a private address they cannot reach. Whatever you choose, the ports of the passive range must be forwarded to the server. The manual describes the settings on the FTP page, and Understanding FTP and its variants explains active and passive mode.