Can't build data connection

Hello everybody,

First of all, thank you to the developpers of ftp-proxy. I'm very
happy that such a tool exists in open source.

I am a new user of ftp-proxy and I am fighting with the problem (using
an active mode client) :

  ftp> ls
  200 PORT command successful.
  425 Can't build data connection: Cannot assign requested address.

or

  ftp> get foo.txt
  200 PORT command successful.
  425 Can't build data connection: Address already in use.

I scratched my hair so often that I lost some, and now I have to ask
some advices.

Here is my context. It is very classic. My network is designed with
two zones :

 - public  zone with public  IP address
 - private zone with private IP address

A firewall (router) filters traffic between the two zones and the
Internet.

A ftp client in the private zone is not able to connect directly to a
ftp server on the Internet, so I'd like to use ftp-proxy on one
machine in the public zone. I want private client able to do download
or upload from/to outside servers. Here is a piece of my poor ascii
art :

Private zone           Public zone      Router        Internet
------------           -----------      ------        --------
ftp client ----------> ftp proxy -------(filter)----> ftp server

The ftp-proxy (version 1.8-2) is installed on an Debian box, with the
configuration below :

# ftp-proxy -c
Config-File: '/etc/ftp-proxy.conf'
Config-Section ------ '(-global-)'
Config:        ActiveMaxDataPort        = '40999'
Config:        ActiveMinDataPort        = '40000'
Config:        AllowMagicUser           = 'yes'
Config:        AllowTransProxy          = 'no'
Config:        DestinationMaxPort       = '42999'
Config:        DestinationMinPort       = '42900'
Config:        Group                    = 'ftpproxy'
Config:        LogDestination           = 'daemon'
Config:        LogLevel                 = 'INF'
Config:        MaxClients               = '64'
Config:        MaxClientsMessage        =
'/etc/proxy-suite/ftp-maxclients.txt'
Config:        MaxClientsString         = 'The server is full'
Config:        PidFile                  = '/var/run/ftp-proxy.pid'
Config:        ServerType               = 'standalone'
Config:        User                     = 'ftpproxy'
Config:        WelcomeMessage           = '/etc/proxy-suite/ftp-welcome.txt'
Config:        WelcomeString            = 'Welcome to the ftp proxy server on
%h'

In order to figure out what's happening, I tried a ftp session from a
private client to a private server (so I can monitor both) via the
proxy :

Private zone           Public zone            Private zone
------------           -----------            ------------
ftp client ----------> ftp proxy -----------> ftp server

I observe the following behaviour :

First, the proxy, has successfully established a control connexion to
the server. Then, to established a data connexion, the proxy sends a
PORT with the *same* port number that is already used. That's why, I
suppose, the server tells the proxy via the control channel "Cannot
assign requested address" or "Address already in use".

Any advice ?
Thanks in advance.

Here is an exemple of wich port numbers are used :

Client       Proxy                      Server
(10.5.0.4)   (193.8.163.6)              (any IP)
-------      -------------------        ------

35271 -----> 21    - - - > 42900 -----> 21
35271 <----- 21    < - - - 42900 <----- 21

The control channel is initiated by the client, and so does the proxy
with the server. No problem.

35272 <----- 40000

The user do a "ls" or a "get", so the client sends to the proxy a
PORT command : PORT 10,5,0,4,137,200 (35272). The proxy establishes
the data connexion. No problem.

			   42900 <----- 20

The proxy sends to the server a PORT command : 
PORT 193,8,163,6,167,148 (42900). The server tries to establish
the data connexion and fails : the port 42900 is already in use,
by the control connexion.

The server sends an error message to the proxy via the control
channel, and the proxy sends it in turn to the client : "Can't build
data connection"

Strange, isn't it ? Or is it normal and have I missed something ?
Any advice will help.

Friendly yours,

-- 
Emmanuel Halbwachs        Laboratoire de Photonique et Nanostructures
tél : 01 69 63 61 34                                      CNRS UPR 20
fax : 01 69 63 60 06                                   Route de Nozay
mailto:[email protected]                91460 Marcoussis

---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]