Extended Passive Mode (EPSV) works but regular PASV doesn't?

[felciano]

Hi --

I'm trying to set up a remote script to back up my site to my local PC. I've got Filezilla Server configured and it seems to work. In particular, I can get via Active FTP as well as ESVP, using http://www.g6ftpserver.com/en/ftptest. So I'm pretty sure my router port forwarding (51000-51100) and Firewall are configured correctly.

However, when trying to log in with PASV mode using the g6ftpserver test I get:

(000004) 5/20/2007 22:06:34 PM - anonymous (87.98.200.117)> PASV
(000004) 5/20/2007 22:06:34 PM - anonymous (87.98.200.117)> 227 Entering Passive Mode (67,188,41,57,199,58)
(000004) 5/20/2007 22:06:55 PM - anonymous (87.98.200.117)> disconnected.

and the g6ftpserver test log reads:

> PASV
* Connect data stream passively
< 227 Entering Passive Mode (67,188,41,57,195,85)
* Trying 67.188.41.57... Timed out
* couldn't connect to host
* Connection #0 to host 67.188.41.57 left intact

FWIW, my broadband is through Comcast. I've tested this with different port forwarding ranges as well as with the firewall disabled, to no avail. I've also reproduced this with a demo version of the G6FTP Server, so it must be a configuration option.

Any suggestions? What is supposed to happen after it "enters" passive mode as in the log above?

Thanks!

Ramon

P.S. Unfortunately I don't have control over the backup process, which relies on PASV, else I'd tell it to use EPSV...

[felciano]

After perusing some of the related posts, I thought it might be helpful to post additional configuration info: I'm running XP 2002 SP2 on a NetGear WGT624v3. Norton Security's Firewall (disabled for these tests). Windows Firewall is installed but disabled.

Ramon

[botg]

Definitely a problem with your router and/or firewall. Either incorrect configuration or broken hard/software.

[felciano]

Wow -- on a hunch I Googled "NetGear WGT624v3 passive ftp" and found http://kbserver.netgear.com/pdf/wgt624v ... 5Apr05.pdf, which includes the text "Note: When SPI Firewall is disabled, you must use the Passive mode in the PC FTP client to connect to the FTP server."

So I tried disabling SPI, and passive FTP now works. According to the NetGear docs:
------------------------
Disable SPI Firewall - The SPI (Stateful Packet Inpection) Firewall protects your LAN against Denial of Service attacks. This should only be disabled in special circumstances.
------------------------
So I'm a little nervous about this -- seems like a temporary workaround at best... Any thoughts?

Ramon

[cszeto]

http://filezilla.sourceforge.net/forum/ ... php?t=3352