Re: proxy_ftp : your opinion ? EPSV / PASV and firewalls

Peter Van Biesen wrote:

> Our firewall  between the proxy and the internet is configured very 
> restrictive, so only known ports are allowed in either direction. This 
> poses a problem with the EPSV/PASV implementation of the ftp proxy; 
> servers that are able to run in EPSV or PASV mode make the proxy produce 
> a "bad gateway" error ( Firewall / NAT ? ). I've temporarly enabled the 
> bypass code but I was thinking of writing a more permanent patch.
> 
> Therefor, please your opinion: there are two ways to implement this :
> 
> 1) add a directive to specify if EPSV and/or PASV should be used

EPSV and PASV are always used.

The logic is try EPSV, if that fails, try PASV, if that fails, try PORT.

> 2) alter the code to continue with PORT where it now throws a bad 
> gateway error

To be honest I think you are probably looking at the broken firewall 
implementation. Try set up the firewall so that it does PASV properly.

Regards,
Graham
-- 
-----------------------------------------
[email protected]		"There's a moon
					over Bourbon Street
						tonight..."