Troubleshooting Active FTP Proxy Connections with pfSense: A Practical Guide

Many users encounter challenges when setting up FTP proxy connections through pfSense, particularly when dealing with corporate environments that rely on active FTP. While basic FTP setups might seem to work initially, issues often arise when more complex network configurations or specific FTP modes are involved. This guide documents a specific scenario and solution for enabling a corporate FTP proxy through pfSense, focusing on overcoming timeouts and connection problems related to active FTP.

Understanding the Problem: Active FTP and NAT with pfSense

The original router setup might have seamlessly handled the FTP proxy, but pfSense, with its more granular control and different NAT (Network Address Translation) configurations, can introduce complications. Users often report being able to log in to the FTP server, but then experience timeouts or failures when attempting to perform actions like listing directories (LIST command). These issues can stem from how pfSense handles NAT, especially with active FTP connections initiated by corporate proxies.

Symptoms of FTP Proxy Connection Issues

Common symptoms include:

• Successful FTP login through the corporate proxy.
• Inability to perform any FTP commands after login, such as LIST, GET, or PUT.
• Timeouts occurring during data transfer attempts.
• FTP clients working correctly when connected directly to the internet, bypassing the corporate proxy and pfSense.

These symptoms often point to a problem with how pfSense is handling the active FTP data connection initiated from the corporate proxy server.

Root Cause: pfSense Outbound NAT and Active FTP

The core issue lies in the interaction between active FTP, Network Address Translation (NAT), and pfSense’s default outbound NAT rules. Corporate proxies frequently utilize active FTP for its broad compatibility. In active FTP, the client (in this case, the corporate proxy) establishes the control connection (port 21) and the server initiates the data connection back to the client on port 20.

When pfSense performs outbound NAT, it translates the source IP address and port of outgoing connections. For active FTP responses on port 20, pfSense’s default NAT behavior can dynamically map the source port 20 to a random port above 1024. This dynamic port mapping causes problems because firewalls or security packages at the corporate proxy or gateway might expect the data connection response to originate from the standard port 20. If the response comes from an unexpected high port, the corporate firewall may block it, breaking the communication and leading to timeouts.

The Solution: Manual Outbound NAT with Static Port Mapping for Active FTP

To resolve this active FTP proxy issue with pfSense, the key is to configure manual outbound NAT rules and implement static port mapping specifically for FTP traffic originating from your internal FTP server destined for the corporate proxy. This ensures that responses from your FTP server on port 20 are translated to originate from your external IP address’s port 20, matching the corporate proxy’s expectations.

Step-by-Step pfSense Configuration for Active FTP Proxy Support

Here’s how to configure pfSense to correctly handle active FTP proxy connections:

1. Bypass pfBlocker (If Applicable): If you are using pfBlocker or similar IP blocking rulesets, create an “allow” rule to ensure that traffic to and from your corporate network’s IP addresses is not blocked. This is crucial if your corporate IP range is included in any blocklists.

2. Port Forwarding for FTP Control Port (Port 21): Configure a port forward rule in pfSense to direct incoming traffic on WAN port 21 to your internal FTP server’s IP address and port 21. This is standard for allowing external FTP access to your server.

3. Switch to Manual Outbound NAT: Navigate to Firewall > NAT > Outbound. Change the Mode from “Automatic outbound NAT rule generation” to “Manual Outbound NAT rule generation”. pfSense will likely populate the rule mappings with a set of automatically generated rules. Leave these default rules in place.

4. Create Static Port Outbound NAT Rule for FTP Data Port (Port 20): Add a new outbound NAT rule by clicking the “+” icon. Configure this rule as follows:

   • Interface: WAN (or your external interface)
   • Protocol: TCP
   • Source:
     • Type: Network
     • Address: Your Internal FTP Server IP Address
     • Port: 20
   • Destination:
     • Type: Any
     • Port: blank (any port)
   • Translation:
     • Address: Interface address (WAN Address)
     • Port: Static Port should be checked.

   This rule ensures that any traffic originating from port 20 of your internal FTP server, when NATed through pfSense, will retain port 20 as the source port on your external IP address.

5. Apply Changes: Save the NAT rule and apply the changes in pfSense.

After implementing these steps, test your FTP connection through the corporate proxy. With the static port mapping for port 20, the corporate firewall should now correctly recognize the incoming data connection, allowing FTP commands like LIST and data transfers to function as expected.

Conclusion

Enabling active FTP proxy connections through pfSense requires understanding the nuances of NAT and how it interacts with the active FTP protocol. By switching to manual outbound NAT and specifically configuring a static port mapping rule for port 20, you can overcome common timeout and connection issues. This configuration ensures compatibility with corporate proxies and firewalls that rely on standard port behavior for active FTP, providing a robust and functional FTP proxy solution with pfSense. This detailed guide should help others facing similar challenges in setting up FTP services behind pfSense in corporate network environments.