DSM-G600, DNS-3xx and NSA-220 Hack Forum

SweMart wrote:

The built in FTP is not "NAT aware", thats a poblem when connecting from the Internet. I think you have two options:
a) Place your NAS in a DMZ with a proper public IP
b) Install another FTP daemon thatis NAT aware

I've compiled proftpd which is NAT aware for the DNS, I'm gonna try to create funpkg package during the day if I get time. proftpd aso supports TLS/SSL enabled transfers.

I don't agree - I have used my DNS-323 with the "native" ftp server, across the internet, behind a NAT firewall and with a single port (21) forwarded.  The ftp client was the "built-in" ftp client in Windows Small Business Server 2003 and used from the command prompt.

What is happening here is the firewall at the client end does not know how to deal with ftp - it is not associating the incoming data stream with the outgoing requests and as a result, sees the incoming stream as being initiated from the outside and discards it.  Just as an example - a Cisco SOHO71 or SOHO91 at the client end will handle this "transaction" flawlessly.

Purely for verification purposes - try putting the client in the DMZ or with a proper public ip

Last edited by fordem (2008-03-28 14:21:34)

FTP from the internet? You know ftp usernames & passwords are sent in clear text and understand the security implications right? Now where's my snoop command gone ;P

http://www.wu-ftpd.org/rfc/rfc2577.html

Hmm,

just got to test ftp again, now that my dns-323 was placed in the DMZ.
Still no go using passive mode.
Active mode fails too, with the message:

Response:    500 I won't open a connection to x.xxx.xx.xxx (only to xxx.xxx.xx.xx)

I'm starting to think that fordem is right, it is at the client end. Will have to test from several networks to check.

But if it appears that I cannot connect to my dns-323 by ftp from any outside network, any ideas what should I check next?

Thanks

uppsju wrote:

But if it appears that I cannot connect to my dns-323 by ftp from any outside network, any ideas what should I check next?

Thanks

Talk to your ISP - some terms of service specifically forbid hosting of servers and the ISP may enforce these terms by blocking the "well known" ports numbers associated with certain services - just as an example, my ISP blocks incoming connections on ports 80, 81, 800 & 8080 - which are all commonly used for web hosting.

Try putting the NAS in the DMZ.