Client could not connect to FileZilla server

[SinGao104]

The following error occurs when I use the domain name to access FileZilla server.
But when I use IP address to access FileZilla server, everything is fine.
And using https://ftptest.net/ to test the domain name was successful.
Thanks in advance for any help.

FilleZilla Cilent Message:
Status: Disconnected from server
Status: Resolving address of MyDomainName
Status: Connecting to DomainNameAddress...
Status: Connection established, waiting for welcome message...
Status: Initializing TLS...
Error: Could not connect to server
Status: Waiting to retry...
Status: Resolving address of MyDomainName
Status: Connecting to DomainNameAddress...
Status: Connection established, waiting for welcome message...
Response: 220-FileZilla Server 1.8.1
Response: 220-Please visit https://filezilla-project.org/
Response: 220 Yes you did it!!!
Command: AUTH TLS
Response: 234 Using authentication type TLS.
Status: Initializing TLS...
Error: Could not connect to server

FilleZilla Server Message:
Response: 220-FileZilla Server 1.8.1
Response: 220-Please visit https://filezilla-project.org/
Response: 220 Yes you did it!!!
Command: AUTH TLS
Response: 234 Using authentication type TLS.
Error: GnuTLS error -110: The TLS connection was non-properly terminated.
Status: Client did not properly shut down TLS connection
Error: Control channel closed with error from source 0. Reason: ECONNABORTED - Connection aborted.
Response: 220-FileZilla Server 1.8.1
Response: 220-Please visit https://filezilla-project.org/
Response: 220 Yes you did it!!!
Command: AUTH TLS
Response: 234 Using authentication type TLS.
Error: GnuTLS error -110: The TLS connection was non-properly terminated.
Status: Client did not properly shut down TLS connection
Error: Control channel closed with error from source 0. Reason: ECONNABORTED - Connection aborted.

[botg]

That's odd. Do you use any firewalls or virus scanners that perform TLS man-in-the-middle?

[SinGao104]

That's odd. Do you use any firewalls or virus scanners that perform TLS man-in-the-middle?

I have a TCP port forwarding service deployed on my cloud server.
It forwards all ports used by FileZillaServer on another server.
And here is the debugging information:

FilleZilla Cilent Message:

Code: Select all

Status:   Resolving address of MyDomainName
Status:   Connecting to DomainNameAddress...
Status:   Connection established, waiting for welcome message...
Trace:    CFtpControlSocket::OnReceive()
Response: 220-FileZilla Server 1.8.1
Response: 220-Please visit https://filezilla-project.org/
Response: 220 Yes you did it!!!
Trace:    CFtpLogonOpData::ParseResponse() in state 1
Trace:    CControlSocket::SendNextCommand()
Trace:    CFtpLogonOpData::Send() in state 2
Command:  AUTH TLS
Trace:    CFtpControlSocket::OnReceive()
Response: 234 Using authentication type TLS.
Trace:    CFtpLogonOpData::ParseResponse() in state 2
Status:   Initializing TLS...
Trace:    tls_layer_impl::client_handshake()
Trace:    tls_layer_impl::continue_handshake()
Trace:    TLS handshakep: About to send CLIENT HELLO
Trace:    TLS handshakep: Sent CLIENT HELLO
Trace:    tls_layer_impl::on_send()
Trace:    tls_layer_impl::continue_handshake()
Trace:    tls_layer_impl::on_read()
Trace:    tls_layer_impl::continue_handshake()
Trace:    CRealControlSocket::OnSocketError(106)
Trace:    CRealControlSocket::DoClose(66)
Trace:    CControlSocket::DoClose(66)
Trace:    CFtpControlSocket::ResetOperation(66)
Trace:    CControlSocket::ResetOperation(66)
Trace:    CFtpLogonOpData::Reset(66) in state 4
Error:    Could not connect to server
Trace:    CFileZillaEnginePrivate::ResetOperation(66)
Status:   Waiting to retry...

FilleZilla Server Message:

Code: Select all

Trace:    Session XXXXXX with ID 680 created.
Response: 220-FileZilla Server 1.8.1
Response: 220-Please visit https://filezilla-project.org/
Response: 220 Yes you did it!!!
Command:  AUTH TLS
Trace:    securer(1) ENTERING state = 0
Trace:    calling tls_layer_->set_certificate_file("PATH\certificate.key", "PATH\certificate.cer", "****")
Trace:    securer(1) EXITING state = 1
Response: 234 Using authentication type TLS.
Trace:    ~securer(1) ENTERING state = 1
Trace:    calling tls_layer_->set_alpn()
Trace:    tls_layer_impl::server_handshake()
Trace:    tls_layer_impl::continue_handshake()
Trace:    ~securer(1) EXITING state = 2
Trace:    tls_layer_impl::on_send()
Trace:    tls_layer_impl::continue_handshake()
Trace:    tls_layer_impl::on_read()
Trace:    tls_layer_impl::continue_handshake()
Trace:    TLS handshakep: Received CLIENT HELLO
Trace:    TLS handshakep: Processed CLIENT HELLO
Trace:    TLS handshakep: About to send SERVER HELLO
Trace:    TLS handshakep: Sent SERVER HELLO
Trace:    TLS handshakep: About to send ENCRYPTED EXTENSIONS
Trace:    TLS handshakep: Sent ENCRYPTED EXTENSIONS
Trace:    TLS handshakep: About to send CERTIFICATE
Trace:    TLS handshakep: Sent CERTIFICATE
Trace:    TLS handshakep: About to send CERTIFICATE VERIFY
Trace:    TLS handshakep: Sent CERTIFICATE VERIFY
Trace:    TLS handshakep: About to send FINISHED
Trace:    TLS handshakep: Sent FINISHED
Trace:    tls_layer_impl::on_read()
Trace:    tls_layer_impl::continue_handshake()
Trace:    tls_layer_impl::failure(-110)
Error:    GnuTLS error -110: The TLS connection was non-properly terminated.
Status:   Client did not properly shut down TLS connection
Error:    Control channel closed with error from source 0. Reason: ECONNABORTED - Connection aborted.
Trace:    Session XXXXXX with ID 680 destroyed.

Thanks for reply.

[botg]

Do you still experience this issue if you don't use a third-party service?

[SinGao104]

Do you still experience this issue if you don't use a third-party service?

Resolving the domain name to the IP address where FilezillaServer resides does not have this problem.

And the new question here is, why is https://ftptest.net/ accessible and Client not under the same conditions.

Thanks for reply.

[botg]

Assuming the hostname resolves to the same IP, it doesn't make a different to FileZilla Server whether you entered the hostname or the IP address in the client. Technically the SNI in the TLS CLIENT HELLO is different, but the server does not make use of it.

I still think that there must be some third-party firewall or virus scanner that is interfering with the connection.

[SinGao104]

Assuming the hostname resolves to the same IP, it doesn't make a different to FileZilla Server whether you entered the hostname or the IP address in the client. Technically the SNI in the TLS CLIENT HELLO is different, but the server does not make use of it.

I still think that there must be some third-party firewall or virus scanner that is interfering with the connection.

Thanks for your help！

According to your reply, I have re-checked the setting information in this respect.

The problem lies with the cloud server provider used for forwarding.

They set up an implicit firewall rule. It's about domain names

The problem was solved. Very thankful.