FTP & Port Mapping?

Ok, I'm pretty new to wireless networking but I have a pretty good grasp of it all. I just have one question about Port Mapping and security. I have to open port 21 on Port Mapping in order for me to use FTP to upload files to my webspace. My question is how safe is it to leave that port open all the time? Or should I continue to close the port after everytime I upload? That's fine but it takes so long to update the Express with the new settings and reset. Kind of a pain.
Anyway, if anyone has an opinion or suggestion for this then it would be greatly appreciated!

Thanks for the quick reply and information Henry!
Well, I guess I would be at minor risk since I don't have my OS X firewall enabled. I just figured that the Express was a better firewall. But if you start punching holes in the wall then it becomes less secure. Hmm.... I guess I would have to enable the OS X firewall then if I want to leave the port mapping enabled on the Express. And just enable FTP access through the OS X firewall when needed.
Of course I have good password protection on the FTP server but then again I would have the port wide open too.
Anyway.... thanks again for your help! It definitely helps me put things in order with what I need to do.

Similar Messages

FTP and Port mapping

Hi
we get troubles with our FTP Server. The clients send a Syn with Src port 40000 then the Server replies with the the same dst port but i presume that the loadbalancer makes a port-mapping and translate the source Port to eg. 33000. Our firewall clearly drops the packet with the reason "Packet out of state". have you any idea ?
Here my config
service h01p6u_21
keepalive type tcp
keepalive port 21
ip address x.x.158.129
protocol tcp
redundant-index 11790
active
service h01p6v_21
ip address x.x.158.130
keepalive type tcp
keepalive port 21
protocol tcp
redundant-index 11800
active
content c01sg5_21
vip address x.x.x.140
add service h01p6v_21
add service h01p6u_21
port 21
protocol tcp
application ftp-control
active
!*************************** GROUP
group srg_c01sg5
vip address x.x.x.140
add service h01p6u_21
add service h01p6v_21
active

Hi Gilles
the problem that I have now is with ACTIVE FTP. I made PBR on the Loadbalancer. Passive FTP works either from the internet and from our internal network while Active FTP works only from the internet and doesn't work from our internal network. What we see is that the Loadbalancer sends the ftp-data packet out to the InternetVLAN (eg. VLAN 3605) and not to the VLAN 3603. I guess the problem is in my access-list. have you any Idea ??
My configuration
!*************************** GROUP ***************************
group srg_c01sg5
vip address x.x.152.140
add service h01p6v_21
add service h01p6u_21
active
!**************************** ACL ****************************
acl 1
clause 10 permit any x.x.172.0 255.255.255.0 destination any prefer FW_VLAN3605
clause 99 permit any any destination any
apply circuit-(VLAN3607)
acl 2
clause 10 permit any x.x.158.0 255.255.255.0 destination any prefer FW_VLAN3603
clause 99 permit any any destination any
apply circuit-(VLAN3610)
clause 15 permit any x.x.158.0 255.255.255.0 destination 10.0.0.0 255.0.0.0 prefer FW_VLAN3603
clause 20 permit any x.x.158.0 255.255.255.0 destination 138.191.0.0 255.255.0.0 prefer FW_VLAN3603
clause 25 permit any x.x.158.0 255.255.255.0 destination 192.168.251.0 255.255.255.0 prefer FW_VLAN3603
clause 30 permit any x.x.158.0 255.255.255.0 destination 192.168.250.0 255.255.255.0 prefer FW_VLAN3603
clause 35 permit any x.x.158.0 255.255.255.0 destination 192.168.0.0 255.255.0.0 prefer FW_VLAN3603
clause 40 permit any x.x.158.0 255.255.255.0 destination 172.16.0.0 255.240.0.0 prefer FW_VLAN3603
acl 10
clause 99 permit any any destination any
apply circuit-(VLAN3605)
apply circuit-(VLAN3603)
apply circuit-(VLAN2421)
apply circuit-(VLAN1)

Enabling ports / port mapping for FTP

Greetings! I have an iMac G5 (Tiger) connected to the internet via an Airport Express. Connected to the Airport is a DSL modem. The Airport uses a static IP for internet access via the DSL modem.
I've enabled FTP services on the G5, and am trying to figure out how to map the appropriate ports to allow FTP access remotely from the internet. I assume I would need to use the static IP with the remote FTP client, then the Airport would route the request to the iMac using port mapping... correct, or incorrect? How, specifically, should this be set up? ie... what ports need opening, routed to where, etc.
Thx!
J

http://discussions.apple.com/thread.jspa?threadID=121828

Port Mapping Filezilla FTP Server

I just got a new AirPort Extreme Base Station (802.11n). I must say, I'm pleased for the most part. I'm having an issue with remotely connecting to my FTP server inside the network though.
Setup:
The whole this is connected as follows:
Cable Modem - AEBS - Wired Windows PC
On this windows PC I run an FTP & HTTP server. Both are functioning properly as they always have, both on the localhost and within the network.
The HTTP protocol is working fine. I have port 80 mapped to my PC's static IP of 10.0.1.100. I can browse my hosted site from a remote PC no problem.
Yet, from a remote PC I am unable to fully establish FTP communication. I have port 21 mapped to my PC's static IP as well. Communication seems to be happening; the remote PC gets prompted for their username and password. Shortly after (within a timeout time), the FTP server replies that it cannout open the data channel.
Data:
Here is the Remote PC's log of the FTP session:
Status: Connecting to $server.com ...
Status: Connected with $server.com. Waiting for welcome message...
Response: 220 $greeting
Command: USER $username
Response: 331 Password required for dave
Command: PASS $pass**
Response: 230 Logged on
Command: SYST
Response: 215 UNIX emulated by FileZilla
Command: FEAT
Response: 211-Features:
Response: MDTM
Response: REST STREAM
Response: SIZE
Response: MLST type;size*;modify;
Response: MLSD
Response: UTF8
Response: CLNT
Response: 211 End
Status: Connected
Status: Retrieving directory listing...
Command: PWD
Response: 257 "/" is current directory.
Command: TYPE A
Response: 200 Type set to A
Command: PASV
Response: 227 Entering Passive Mode (10,0,1,100,16,141)
Command: LIST
Response: 425 Can't open data connection.
Error: Could not retrieve directory listing
Solutions Attempts:
I have tried mapping the FTP data port (20) to the server's static IP to no avail. I even went as far as setting the server as the default host (DMZ); this didn't work either.
Am I looking at a fresh firmware bug here or am I missing anything? Thanks for your help.
P.S. No changes have been made on the server and every other no name router I've used has successfully port mapped the server; it's definitely the new hardware.
Windows PC Windows XP Pro
Windows PC Windows XP Pro

1. Try to connect to your FTP-Server in AKTIVE-Mode,
it's a setting in your FTP-Client
Most all FTP clients are defaulted to passive mode, and I want to connect without asking all users to change their settings.
Previous routers did not require anything like this, why would this new base station obfuscate the setup?
2. Don't use the same AirportXtrem internet
connection (for testing your FTP-Service) where is
your FTP-Server behind. I don't know why, when I try
to establish a connection I could not go out and come
back through my AXtrem on the same way.
Try it with a Modem, UMTS or with another internet
connection.
I don't know exactly what you're talking about. Please explain better or with more details.
Windows PC Windows XP Pro

Port Mapping...access home network remotely

Hello,
Has anyone successfully established port mapping through the AE (802.11n)?
SSH access has worked for me but nothing else. Apple tech support was courteous but unable to solve problem.
I'm trying to get port mapping (port forwarding on other routers) to work for AFP and FTP.
Any help would be appreciated.
Greg
iMac, MacBook Mac OS X (10.4.8)

Hi Greg,
Thanks for your response. I will try it out.
Yes, I did get her the new AE 802.11n.
I am so impressed by it, I would go buy it for myself to add the print server capability, and dual band feature.
To take advantage of N, I will either get a new Macbook Pro, or a new wireless card for my PB G4, preferrably the former.
Cris
Hi Cris,
I have actually been successful now with AFP too.
Does your sister have the new AE 802.11n? That's the
one I have and here's what I did.
1) Open AirPort Utility
2) Select Airport Extreme
3) Menu "Base Station", "Manual Setup"
4) Select Advanced icon
5) Select Port Mapping tab
6) Click "+"
7) Select a service "SSH" or "AFP" which ever you
prefer.
8) For ssh, private tcp port needs to be 22. Public
IP address should be the IP address of your sisters
imac on her local network. Private TCP port should be
22.
AFP is the same setup as ssh, except the Public tcp
port should be any unused port number, for example
5912. (You can get a list of used port numbers here:
http://docs.info.apple.com/article.html?artnum=106439
) and the private tcp port needs to be 548.
Helping your sister out will be much easier when OS
10.5 becomes available later this spring and perhaps
by the end of this month. Go to this link and click
on the iChat icon. It will show you ichat's new
capabilities. http://www.apple.com/macosx/leopard/
Hope that helps,
Greg
iMac, MacBook Mac OS
X (10.4.8)
Powerbook G4 (17") Mac OS X (10.4.9)

Some Port Mapping help.

Ok was using a verizon wireless router/modem with my mac network. Did all my portmapping right through verizon router controls. (About the only thing that worked well).
Now......
I have an airport extreme N router. I am still using the verizon router as modem. I have a ethernet cord going out of the verizon router into my airport WAN connection. I tried port mapping in the airport extreme for FTP to my office server and now no traffic can connect. Is there something im still suppossed to be doing to the verizon router???? I have all wireless capabilities on the verizon turned off as well as any mapping. Verizon has been no help in this. I am mapping port 21 to that specific computer with people loggin in to my outside IP its definitely the right ip. Where is this getting stopped?

With this setup, you have two local network layers. Your Verizon router is distributing the 192.168.1.XXX addresses, one of which is being assigned to your Airport. Then your Airport is distributing 10.0.1.XXX addresses to any of the computers connected to it.
If the Verizon router is not forwarding any ports, then you will have no access to your local network(s) from the outside. If you want FTP access to a computer that's connected to your Airport, then you will need to forward port 21 from the Verizon router to the Airport's 192.168.1.XXX address, and then from the Airport to your computer's 10.0.1.XXX address. I believe this will work, but I have never tried that 2-layered setup myself.

Linksys App bug with port mapping

So I have the Linksys app installed on my Android phone. My router, WRT1900AC, is set up using port mapping. The port mapping is for an ssh app to control my 3 web servers. Each servers internal port is 22 and each servers external port is 20, 22, and 23 each one mapped to port 22. When signed in the the routher itself, not through the app, I can configuer these ports fine. However when I attempt to configuer these ports or the ip appress through the app, I get an error saying the port is in use. It seems the app is seeing the three servers using the same internal port and throwing an error.
Has anyone else experienced this?

I recommend you not use ports in the first 1000 unless they are for the standard server they are specified for. This is a good IT policy.
Example:
Port 22 External to internal IP Address of SSH server port
Port 21 External to internal IP Address of FTP server port
Instead use undefined ports in the higher end of the range.
Example:
Port 10001 External to internal IP Address of SSH server port
Port 10002 External to internal IP Address of SSH server port
The Linksys stock firmware will only do DNS proxing which isn't great for server networks.
For this application I recommend OpenWRT McWRT v1.0.5:
https://github.com/Chadster766/McWRT/releases
Install luci-ssl to enable SSL access and open router port 443 for standard secure remote access.
FYI:
Unless you have a USB to TTL cable for firmware recovery I recommend always flashing OpenWRT using the Linksys stock UI. This will put the Linksys stock firmware into the alternate boot image in case manual recovery is needed.
Do not delete the LAN, WAN and WAN6 interfaces. Pay attention to OpenWRT notices that say things are not reversible. OpenWRT can be unforgiving in those circumstances. If you have the $9.00 USB to TTL cable it won't matter because you can always load firmware through the boot loader.
OpenWRT McWRT has some issues:
https://github.com/Chadster766/McWRT/issues
Please remember to Kudo those that help you.
Linksys
Communities Technical Support

AirPort Extreme FTP port is open when doing Remote Port Scan

I have a question regarding the AirPort Extreme Base stations running firmware 7.7.3. Currently the AirPort is not port-mapping any services, however when I do a remote port scan of that particular AirPort I have noticed some TCP ports are open from the outside, such as FTP port 21, RTSP port 554 and ARCP port 7070. Why is that? I thought the AEBS blocks these services by default, unless otherwise configured to be open. Is this a vulnerability with the firmware?

TCP and UDP ports used by Apple software products - Apple Support
Your 554 and 7070 may be open due to links to itunes store. It is not a big vulnerability since it is for streaming.
Port 21 is more a concern.. It is used internally by the AE apparently.. but I really do not know why. FTP as a protocol is not offered to the outside world. so you cannot connect to it and get info for files.. even if you have a hard disk plugged in. Why it should be open to the outside world I am not sure.
Do you have BTMM turned on? It may be involved with remote services.
If you are concerned it is not hard to fix.. port map those ports to a non-existent client in the network.. however your itunes store connection might stop working as well as some other things... that need those ports open.. There is also a good chance you cannot map them when they are used.. so do a factory reset and before you setup other applications or BTMM do the port map and see what happens.
You can also post the details to apple directly but I honestly doubt you are facing any big issues here.

Time Capsule Does Not Port Forward FTP Ports

Hey there,
I recently purchased a Time Capsule, and I found out that while it fixes the NAT-PMP bug found in my previous AirPort Extreme Base Station (Gigabit-N), it introduces a new problem which makes it refuse to forward port 21 properly.
It seems to me that the Time Capsule has some sort of FTP server built in, and is either enabled but closes connection on client connection, or disabled but still listens for client connection.
This message is what I get when I connect to my IP via FTP from the WAN side (FTP port forwarded to a local machine with an IP 10.0.0.8):
421 Service not available, remote server has closed connection.
When it is accessed from the LAN of course, I can connect to 10.0.0.8 with no problem. However, what is interesting is if I connect to the Time Capsule via FTP I get this as well:
421 Service not available, remote server has closed connection.
Thus, I am 100% certain that the FTP message I see when I connect from WAN is from the Time Capsule instead of the machine I port forwarded to.
Apple needs to fix this annoying problem and at the same time fixes some VPN issues I'm having with my Nortel VPN client (4.68). It was all working when I had the AirPort Extreme Base Station.

I am having a problem establishing an FTP session that is started with my FTP Client (CuteFTP) on my local network and attempting to connect to an FTP Server with one of my hosting providers. My first few attempts used FTPS (Secure FTP) as that is what I typically use when transferring FTP packets over the net. Well, this didn't work so I thought maybe the Time Capsule had a problem inspecting the encrypted packets so I switched to standard clear-text FTP just to see if the Time Capsule handles FTP session management functions correctly. This didn't work either. I'm using PASV FTP and have never had a problem before with my CISCO Router or with another consumer-based NAT router. I don't believe that the Server on the Internet gets the initial request on port 21 as I believe the Time Capsule is not allowing the packet to pass and my FTP Client spits back an error message : "Couldn't access FTP service " "Connection Failed". I have also used "Terminal" and initiated the ftp utility and attempted to connect to the same server and receive the following error message : "421 Service not available, remote server has closed connection.". I have attempted to put my computer in the DMZ by using the Default Host feature on the Time Capsule but that resulted in the same errors. I believe that I have tried most of the settings available on the Time Capsule to attempt to get this to work but no luck yet. If the packet is getting through to the server and the response back on the current ephemeral port is not getting through the Time Capsule I'm really hoping the solution is not having to port map all ephemeral ports as this is in the tens of thousands. Has anyone successfully established an FTP Session (Secure or Not) from your local client through the Time Capsule to a Server on the Internet. If so, could you help by providing any Time Capsule settings that were required for this to function properly....Thanks in Advance.
Note: I have attempted to ftp to several different public ftp servers on the Internet and get the same error results. I have no problems ftping to local serverson my local network.

How do I use Port Mapping?

b How do I use Port Mapping?
(This document will assume that you are using and ABS/AEBS/AX as an internet router and have DHCP & NAT turned on.)
Sometime you may want to offer access to a computer on your AirPort network to users on the internet, whether it be a web site, or for file sharing, or just remote access for yourself when traveling. If any of these sound like something you want to do, then you need to understand how Port Mapping works.
b AirPort as Firewall
Most of the time your AirPort base station will not let any traffic into your network which did not originate from your network. It will let everything out and replies to your traffic back in, but it will not let sessions initiated on the internet side of the base station in to your network. This is what is referred to as the "NAT firewall" capability of the base station and it provides effective protection for your network from the internet. What Port Mapping does is poke a hole in this wall to allow certain type(s) of traffic into the network and direct this traffic to a specific computer on the network. In the firewall world this is commonly referred to as an "inbound proxy" or "inbound translation" rule or "PAT" (Port Address Translation) in the router world.
b The Need for Manual Addressing
Since a Port Mapping entry in the base station configuration requires an inside private IP address to be specified, the computer to which to mapping entry applies should always have the IP address specified in the mapping entry. Thus, DHCP should not be used for a computer offering services on the internet as the Port Mapping entry will no longer work if the target computer's IP address changes. In general, an Apple base station's DHCP server will try to assign IP addresses in the 10.0.1.2 to 10.0.1.200 range. IP addresses above 10.0.1.200 can be Manually assigned to computers and other devices on the network up to 10.0.1.254. 10.0.1.255 is reserved (it is the broadcast address for the 10.0.1 subnet). To Manually set up the TCP/IP information for a Macintosh running Mac OS X, go to System Preferences -> Network and "Show" the appropriate interface (Ethernet or AirPort) and click on the TCP/IP tab. Select "Configure Manually" and enter the following information:
IP address : 10.0.1.201 (or whatever address you decide to use)
Subnet mask : 255.255.255.0
Router IP : 10.0.1.1 (the AirPort base station LAN IP)
DNS server : 10.0.1.1, or whatever DNS server IP your ISP uses
After making these changes verify that your computer can still access the internet and local resources on the LAN before continuing.
b Port Mapping a service
In our example we will be hosting a web site on a computer which we have given an IP address of 10.0.1.201. Basic web sites are accessed using the HyperText Transport Protocol (HTTP) and this protocol typically uses port 80 to communicate. In order for others to see the web site, we must configure a Port Mapping entry in the base station configuration to not only allow the web browsers in, but to tell the base station what IP address the web server is using. The Port Mapping entry has three parts: Public Port, Private IP, and Private Port. In this case you would use the following values:
Public Port : 80
Private IP : 10.0.1.201 (this is the computer hosting the web site)
Private Port : 80
In order to access the web site from the internet, users must reference the base station's WAN port public IP (determined by looking at the base station configuration summary page in the AirPort Admin Utility). Since this address may change over time, you might want to use a Dynamic DNS service to simplify connecting for your users.
Sometimes the port you wish to use may be blocked by the ISP. In this case, use a different non-standard Public Port number for the service, but keep the Private Port standard. In the above example, if the ISP was blocking port 80, you could potentially use 8080 instead, so:
Public Port :

Public Port : 8080
Private IP : 10.0.1.201
Private Port : 80
Your users would then have to enter "http://<publicIP>:8080/" (where <publicIP> is the public IP address of the AirPort base station) to access the web site.
b Internal Access
It should be noted that when accessing these services from within the network you cannot reference the Public IP/Public Port, but rather you must use the Private IP/Private Port. Thus, "http://10.0.1.201:80/" in the above example.
b Limits and Options
There is a maximum of 20 Port Mapping entries that can be made in an Apple base station configuration. If you use an AirPort Extreme or AirPort Express base station there is an option which can be helpful in the case where you need many ports opened to a single computer. This is the "Default Host" option. When using this it is not necessary to use Port Mapping at all as all ports will be opened to the specified "Default Host". This is found in "Base Station Options". The default IP address for the "Default Host" is 10.0.1.253. You may change this IP address. The target computer must be Manually configured as specified above with the same IP address. Since all ports are now open to this computer, you should enable and configure the Mac OS X firewall on the default host computer to protect it from intruders.
b Useful Related Links
<a href="http://docs.info.apple.com/article.html?artnum=52002>"Designing AirPort Extreme Networks: Manuals</a>
"Well Known" TCP and UDP Ports Used By Apple Software Products
IANA Port Number Assignments

Cisco ASA 5505 - Port Mapping

Hi, I'm new into IT and I was wondering if somebody could help me set up Port Mapping. Here's my scenario -
We have set up an Asterisk VoIP server that uses UDP port 5060 and another port range, and we want any public incoming connections destined for our Asterisk server on Port 5099 to be translated at the firewall to go to our Asterisk server on port 5060. I have been using ASDM 6.4 but theres no easy way to do this (as far as I know, and why I've came here looking for an answer).
We have currently just left port 5060 open to the public (so our home workers can use our phone system) but really want to get this sorted ASAP due to SIP Bots that look for ports like 5060 that are open!!
Any help would be greatly appreciated and if anybody needs anymore information just ask!!

Hi,
You need to have a NAT rule set for port-forwarding to make as per your requirement..... I will give you cli based configuration example....
If your ASA is running with pre-8.3 version:
static (inside,outside) tcp interface 5099 192.168.1.10 5060 netmask 255.255.255.255
If your ASA is running with post-8.3 version:
object network SERVER-01
host 192.168.1.10
object network SERVER-01
nat (Inside,Outside) static interface service tcp 5099 5060
Regards
Karthik

How do I set up my Belkin router to forward ftp port to macMini?

I am trying to set up my spare macMini (non-intel) as an ftp server, but I am not able to connect to the ftp server (office) from a remote location with my MacBook Pro (home). I have tried to make the right settings as below:
1. forwarded ports 20 and 21 on my Belkin router to the private IP of my macMini (192.168.2.15)
2. set up a dynamic dns account xxx.dyndns.org so that this domain is updated with the current public IP
3. set Sharing Preferences to allow ftp access and turned off the Firewall
I think the port forwarding info is not correct because it does connect if I use the DMZ setting and hard code the public IP to the private IP.
Any help appreciated,
Cynthia

Are you sure that your Internet Service Provider (ISP) doesn't block the ftp ports?
Is is fairly common these days for ISPs not to allow any kind of file server on ordinary household contracts.
Anyway, I'd suggest you rule that out before you get further into the intricacies of port forwarding.
I also hope that you only have the firewall turned off for the ftp ports -- or if not, that your router has firewall protection.

How do I configure my airport utility for port mapping?

I am trying to view my FOSCAM cameras over the internet while away from home. They work fine in my house using Wi-Fi. Instructions say to do port forwarding. I have cameras set up, but can't get my router to port forward. I found "Port Forwarding" in Airport Utlility then NETWORK. 'Router mode: DHCP and NAT';on 'Port Settings I click on the "+" at the bottom. 'Private IP Address: populates to 10.0.1.201'. What goes in the other blocks?

Please check out the following AirPort User Tip for details on how to configure Port Mapping on the AirPort routers. I would suggest that you check your FOSCAM documentation as to what TCP and/or UDP ports are required to access their IP cameras from a remote location.

Port Mapping is not working ?

First of all, sorry for my bad english as it is not my primary language.
So my problem is that I play Warcraft 3 and that I would like to host some games. To be able to host, I have to do port mapping for the ports : 6112-6119, which I did in the Airport Utility --> Advanced --> Port Mapping. I did it for every port 6112, 6113, etc. But the thing is that when I go on this website: http://www.whatsmyip.org/ports/games/ (Which is a website that tells me what ports are open on my computer), only port 6112 is open. Ports 6113-6119 are closed. Before my Airport Extreme, I had a Linksys and I had no problems with hosting and port mapping, which means it is not my ISP that is blocking the ports.
Also this is the setup of my internet if it can help. I have an AirPort Extreme wich is connected to the modem in my basement (I did the port mapping on this one) . From this Airport Extreme, I have another Airport Extreme connected to it. I am connected to the second Airport Extreme in bridge mode with ethernet.
I don't know if this was clear or not lol. Anyway I would appreciate any help. Thank You !

This is just a guess, but if you still have that AirPort Extreme, you might plug it in long enough to have AirPort Utility do a File >Export Configuration File, then reconnect the Time Capsule and do a File > Import Configuration File. Once that's done you may have to do a little adjustment to account for the disk drive.

Port Mapping is not working on Time Capsule

I have replaced my Airport Extreme with a Time Capsule for back up purposes, but the Port Mapping functionality is not working as it did on the Airport Extreme. I have my security camera DVR connected to the network and am using Dynamic DNS to resolve the WAN IP Address. HAs anybody any experienced this problem with Time Capsule?

This is just a guess, but if you still have that AirPort Extreme, you might plug it in long enough to have AirPort Utility do a File >Export Configuration File, then reconnect the Time Capsule and do a File > Import Configuration File. Once that's done you may have to do a little adjustment to account for the disk drive.

FTP & Port Mapping?

Similar Messages

Maybe you are looking for