Re: problem with passive ports and Firewall

Jim,

I'm assuming that you are running a stateful inspection firewall.
Stateful firewalls maintain connection tables of source address/port -
destination address port.  Once connections are terminated, these
firewalls slowly (often way too slowly) time out these sessions from the
state connection tables.  Now, if you have the situation were I ftp to you
- quickly transfer a file - terminate it - and immediately repeat this
process - and if my client is soo wise to happen to pick the same source
ports (since they are now available) - the stateful firewall may interpret
this as a duplicate connection (or connection out of state) and drop the
packets.

I think the best approach would be to review the connection table time out
features and attempt to adjust them to closely follow that of both the
client type and server type.

ted keller


On Fri, 6 Aug 2004, Jim Michaud wrote:

> I got a complaint from a customer of ours who is trying to ftp us data but
> would get timeouts when doing transfers to us. I was finally able to
> reproduce the problem and it appears it happens when two succesive file
> transfers use the same passive port.
>
> I'm trying to figure out why it is getting the same passive port multiple
> times in a row.  I assume that it has to do with the speed (it only happens
> with small transfers) or it is losing a close packet somewhere.
>
> The timeout is cause because our firewall which is keeping track of the
> session. I'm guessing it closes the dynamic rule when it sees the passive
> port close...but since another one has opened up, it ends up blocking the
> second transfer (I can see the blocks in the FW logs)
>
> the FTP server is running
> wu-ftpd 2.6.2
> I've tried the versions from sunfreeware and built the latest version of
> wu-ftpd myself and ran on Solaris 6 and 7.  All of them have this problem.
> I tried doing it on a linux machine, but cannot seem to get it to repeat
> since the transfer speeds are much slower(a whole different issue)
>
> Active mode is not an option and I would prefer a solution where I didn't
> have to open up a bunch of ports on the firewall.  I know I could limit the
> rang of passive ports and the open up those ports on our firewall, but  I
> would prefer to leave the firewall alone.
>
> any sggestions?  is this a bug?
>
> Jim Michaud
>
> Here is the log of the FTP session
> ftp> mput *
> local: CHANGES.TXT remote: CHANGES.TXT
> 227 Entering Passive Mode (X,X,X,X,238,246)
> 150 Opening BINARY mode data connection for CHANGES.TXT.
> 226 Transfer complete.
> 103884 bytes sent in 0.0168 secs (6e+03 Kbytes/sec)
> local: CHANGES.TXT.1 remote: CHANGES.TXT.1
> 227 Entering Passive Mode (X,X,X,X,238,246)
> ftp: connect: Connection timed out
> local: CHANGES.TXT.10 remote: CHANGES.TXT.10
> 227 Entering Passive Mode (X,X,X,X,17,75)
> 150 Opening BINARY mode data connection for CHANGES.TXT.10.
> 226 Transfer complete.
> 103884 bytes sent in 0.349 secs (2.9e+02 Kbytes/sec)
> local: CHANGES.TXT.2 remote: CHANGES.TXT.2
> 227 Entering Passive Mode (X,X,X,X,146,203)
> 150 Opening BINARY mode data connection for CHANGES.TXT.2.
> 226 Transfer complete.
> 103884 bytes sent in 0.234 secs (4.3e+02 Kbytes/sec)
> local: CHANGES.TXT.3 remote: CHANGES.TXT.3
> 227 Entering Passive Mode (X,X,X,X,146,203)
> .
> .
> .
>