0

I have a ZTE mf283+ router and another tp-link archer c7 router connected to it that I use as an access point. Tp-link's ip address is 192.168.0.23 and I have ftp server set up on it. I tried port forwarding so I can access ftp server from outside: enter image description here

But when I try to access it from outside like this: ftp://37.xxx.xxx.xxx:21 it says "This site can't be reached 37.xxx.xxx.xxx refused to connect. Am I doing something wrong or is it something with my ISP?

  • 2
    Read up on 'active' vs. 'passive' FTP: stackoverflow.com/a/1699163/1347519 – Attie Sep 24 '17 at 9:52
  • @Attie I read it but I don't see how that helps me. – Nenad Sep 24 '17 at 9:57
  • Nicely done, @Attie. I see your comment came in about 10 minutes after the question was asked (late at night, in America). Although it didn't entirely work out, you did quickly point the question asker to a useful resource that correctly addresses the technical issue, so despite Nenad's response, I want to let you know that I appreciate the fine job you did, because such efforts often work out by providing the needed information in minimal amounts of time. Please keep it up! :) – TOOGAM Sep 24 '17 at 10:38
  • 1
    37.xxx.xxx.xxx is handled by RIPE NCC (see: Wikipedia on Réseaux IP Européens Network Coordination Centre), which suggests a nation that's gold on this RIR map. Weren't trying to reveal that? If really trying to anonymize, I suggest: use something starting with "203.0.113." or "198.51.100." (for external addresses; I often use "192.0.2." for internal addresses), as reserved by RFC 5737 – TOOGAM Sep 24 '17 at 10:48
2

Thank you for reading the article that Attie pointed to. It sounds like you may just need a bit more explanation. I've found OpenBSD's firewall guide, section on "Issues with FTP" to be informative. However, I will try to summarize the issue here.

When software communicates using the Internet Protocols (IPv4 or IPv6), the "IP protocol" (which I am using as a generic term, applying equally to IPv6 and IPv4) includes a destination IP address. When you use some protocols like TCP (which FTP does), UDP (which DNS does), SCTP, you also have a "port number" which is part of the reason we use the term "port forwarding". (Some protocols don't use a "port number". For instance, ICMP uses IP, and has "Message Types", but not "port numbers".)

Most software will provide IP address information to the local computer's TCP/IP networking components, and only provide the remote computer with "payload" (which is whatever other information that the remote computer needs to receive). For instance, with HTTP, your web browser tells your local TCP/IP network stack to open a connection to an IP address, and your web browser tells the remote system what file it wants to receive. Your web browser doesn't announce your IP address. That detail is handled by the TCP/IP networking components.

FTP is different from most software.

FTP actually includes the IP address in its payload. So, in addition to providing the IP address as part of the standard IP packet, part of the FTP conversation mentions what IP address to use. Standard "port forwarding" just modifies the standard location for an IP address, and doesn't modify the FTP conversation.

FTP is a very old protocol, written during the era when universities and major corporations made the network as a research project. Internet defenses like firewalls didn't exist, and weren't needed, at the time. So, the problem that FTP provides was not an issue of poor authorship. The problem is just that FTP was just designed for a different style of network.

This problem is something that can be worked around three different ways:

  • You could try using "passive" FTP. This can work with an FTP server that is behind a firewall (but the burden is shifted: the FTP client needs to not be behind a firewall... so often this scenario doesn't work well either). If this fix is possible (which requires that the FTP client software supports this feature), this can be the fastest fix (changing a setting in the FTP client software), but could be easy or difficult depending on what FTP client software is used.
  • many routers have support for an option called "ftp proxy" which will modify the FTP conversation, effectively fixing this problem for you. Find and enable such an option (if it exists)
  • use a different protocol that doesn't have the same problem

FTP is kind of unique. Most popular protocols today don't have the same problem, and won't, because firewalls do exist now and so people are aware of the problem. (If someone wrote a new protocol and that person was unaware of the problem, they would probably be made aware of the problem before the protocol gets to be very popular.) However, FTP was the best solution at one point in time, and people were reluctant to use other solutions. One key reason for this may be that a lot of people had FTP software, including popular web browsers that supported FTP.

Nowadays, there are available solutions better than FTP. Use the "SSH File Transfer Protocol" (one of the protocols called "SFTP"), or SCP, or HTTPS. Any of these don't require special proxies to run on the firewalls. For solutions that need to be easily available for multiple customers, HTTPS can do the trick. (There may even be other options, like FTPS, but I recommend the prior protocols I just mentioned.)

So, the final bullet point is recommended, but if you feel like you can't do that for some reason, you could try the first or second bullet points (each of which might be a faster, though inferior, fix to the problem you're dealing with).

  • I'm always surprised when people use FTP these days... I think you've hit the nail on the head though - don't use FTP, use SFTP / SCP (or other), for many, many reasons. Thanks for your appreciation too! – Attie Sep 24 '17 at 11:21
  • @Attie how can I use any of those other protocols? – Nenad Sep 24 '17 at 20:09
  • 1
    Nenad: That really should be a separate question, because it is unrelated to why the firewall blocked your FTP traffic. To save everyone time, I will be nice and just answer your question here: see WinSCP.net's guide to Installing SFTP/SSH Server on Windows using OpenSSH. However, if you have any further questions about that process, please make a separate question. – TOOGAM Sep 25 '17 at 1:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.