Subject: Re: Web browser can't connect wu-ftp on a Sequent

From: [email-masked] (SARAO)
Date: Wed, 3 May 1995 10:06:40 -0400

Thanks Jim,

        I thought I was going to have to fight this battle by myself.
We have a web site www.powersoft.com and we found that Netscape was
the biggest culprit. Mosaic has no problems and Internetworks worked
fine in getting to our ftp site via the web. I even put the port number on
the URL and netscape changes the port. For example our URL could be

ftp://ftp.powersoft.com:21/pub 

and the Netscape browser (any version) translates that to

199.93.177.4:1222 (1222 is arbitrary and it constantly changes)

I would be quite appreciative if someone knows a fix because Netscape
says its a problem on my end...

                                        /Sarao

>Hi,
>
>Has anyone experienced a problem where certain web browser can not
>connect to wu-ftp?  I am running wu-ftpd version 2.4 on a Sequent
>DYNIX/ptx V4.0.1 i386.  The only web browser that we know of to
>connect is the unix version of Mosaic.  The windows version of
>Netscape and Mosaic are get stuck after they have issued the PASV
>command.  The unix version of lynx and Netscape seem to passing
>commands to wu-ftp, but no results are ever returned.  Our anonymous
>ftp server is located at "aps.org".  Thanks in advance for any assistance.
>
>Jim Egan
>
>
>
           ************************************************
           *    The lone wolf travels fastest.            *
           *                         -NN09-               *
           ************************************************

---

From: Bob Sutterfield <[email-masked]>
Date: Wed, 3 May 95 11:31:47 -0400

[email-masked] writes:
   Dan Thorson writes:
      You said:
         The windows version of Netscape and Mosaic are get stuck
         after they have issued the PASV command.  The unix version of
         lynx and Netscape seem to passing commands to wu-ftp, but no
         results are ever returned.

      Check your router filters.  In PASV mode, the client (outside
      your firewall) needs to connect to a high numbered port on the
      server (running ftpd).  This is commonly filtered out.
      
   I thought I was going to have to fight this battle by myself.  We
   have a web site www.powersoft.com and we found that Netscape was
   the biggest culprit. Mosaic has no problems and Internetworks
   worked fine in getting to our ftp site via the web. I even put the
   port number on the URL and netscape changes the port. For example
   our URL could be

   
   
   I would be quite appreciative if someone knows a fix because
   Netscape says its a problem on my end...

FV Admin writes:
   The web browser may be trying to use PASV, which implies the server
   is going to make connections on arbitrary ports rather than the
   client accepting them. If your wu-ftpd does that yet you have a
   firewall between your FTP server and the client (or the client's
   firewall) then the data connection may time out while the control
   connection is fine.
   
   I'm told that most browsers will take a 500 from PASV and fall back
   on PORT, but I haven't had a chance to patch our code yet.
   
If your FTP server (any server, not just wu-ftpd) lies behind a
screening (packet-filtering) firewall router, and you want people to
be able to use your archive using tools like Netscape's WWW browser
client, you have two choices:

(1) Allow all high-TCP-port connections all the time

(2) Use a router with a dynamic packet filter that can watch the FTP
    command stream and use the port negotiations there to create
    temporary pass-through openings in the filter.

The vulnerabilities associated with option (1) are what lead people to
create sophisticated double-gateway DMZ firewalls.  I could suggest a
vendor of routers that can accomplish (2) but that would be
advertising, which would be unwelcome here :-)

But if you're interested (for educational reasons) in a more complete
discussion of the technique, complete with an example of a secure way
to handle PASV and everything else that FTP clients and servers try to
exchange, visit http://www.MorningStar.Com/dynamic-filter.html.
--
Bob Sutterfield, Network Environmentalist
Morning Star Technologies, Inc.                                 +1 614 451 1883
3518 Riverside Dr, Suite 101, Columbus Ohio USA, 43221-1754     +1 800 558 7827
[email-masked]   http://www.MorningStar.Com/bob.html  Fax: +1 614 459 5054