firewall rb obara prenos data

[ dendic @ 26.09.2014. 18:45 ] @

Pokusavam izmedju dva servera progurat ftp data prenos kroz firewall mikrotik rb450G. Nakon uspostave konekcije kroz port 21 prenos mi pada kroz ftp port 20. Ima li ko iskustva sa mikrotikom kao firewallom,da li bi neki drugi model rb-a bolje se ponasao?

_{[Ovu poruku je menjao dendic dana 26.09.2014. u 23:23 GMT+1]}

[ Aleksandar Đokić @ 27.09.2014. 15:17 ] @

Jel problem to sto ti "pada" na port 20? To je normalno, ftp protokol po RFC-u koristi port 20 za data prenos (cenim da si to znao).

Ili ode CPU rutera na 100%?

[ dendic @ 27.09.2014. 17:57 ] @

nakon uspostave konekcije preko 21 krene datq prenos i morat cu onda upratit CPU.ako ode na 100 morat cu jacu masinu instalirat ili neki bolji rb

[ dendic @ 28.09.2014. 18:19 ] @

kako funkcionise ovaj port 20 jel firewall treba na obje strane otvoren za ovaj port.isto tako ako se prenos podataka vrsi preko pasivnih portova 53000-53200 nije mi jasan protok podataka jel onda port 20 ima ikakve veze

[ Aleksandar Đokić @ 28.09.2014. 20:28 ] @

Ne, 20 je dst (na ftp serveru). Na klijentu je src.port+1 na koji se server "kaci" sa porta 20.

Najbolje ovako:

Citat:

Active FTP

In active mode FTP the client connects from a random unprivileged port (N > 1023) to the FTP server's command port, port 21. Then, the client starts listening to port N+1 and sends the FTP command PORT N+1 to the FTP server. The server will then connect back to the client's specified data port from its local data port, which is port 20.
From the server-side firewall's standpoint, to support active mode FTP the following communication channels need to be opened:
FTP server's port 21 from anywhere (Client initiates connection)
FTP server's port 21 to ports > 1023 (Server responds to client's control port)
FTP server's port 20 to ports > 1023 (Server initiates data connection to client's data port)
FTP server's port 20 from ports > 1023 (Client sends ACKs to server's data port)

Passive FTP

In order to resolve the issue of the server initiating the connection to the client a different method for FTP connections was developed. This was known as passive mode, or PASV, after the command used by the client to tell the server it is in passive mode.
In passive mode FTP the client initiates both connections to the server, solving the problem of firewalls filtering the incoming data port connection to the client from the server. When opening an FTP connection, the client opens two random unprivileged ports locally (N > 1023 and N+1). The first port contacts the server on port 21, but instead of then issuing a PORT command and allowing the server to connect back to its data port, the client will issue the PASV command. The result of this is that the server then opens a random unprivileged port (P > 1023) and sends P back to the client in response to the PASV command. The client then initiates the connection from port N+1 to port P on the server to transfer data.
From the server-side firewall's standpoint, to support passive mode FTP the following communication channels need to be opened:
FTP server's port 21 from anywhere (Client initiates connection)
FTP server's port 21 to ports > 1023 (Server responds to client's control port)
FTP server's ports > 1023 from anywhere (Client initiates data connection to random port specified by server)
FTP server's ports > 1023 to remote ports > 1023 (Server sends ACKs (and data) to client's data port)

http://slacksite.com/other/ftp.html

[ dendic @ 28.09.2014. 22:00 ] @

ako koristim aktivne ftp portove znaci li to da bi mi port 21 i 20 trebali biti otvoreni ako ih npr testiram sa open check port stranice? 21 mi javlja da je otvoren na firewallu a 20 da je zatvoren. znate li vi bilo koju ip adresu koja javlja da su otvoreni i port 21 i port 20

[ Aleksandar Đokić @ 29.09.2014. 11:05 ] @

U brzini sam ti lose napisao, na strani servera port 20 je src, tako da ne mora da bude otvoren prema serveru ako firewall ima "statefull" pravila.

Tako da je odgovor da ne mora da pokazuje da je otvoren port 20.

Uzmi u ozbir da i dalje neces imati aktivan prenos ako je na strani klijenta PORT+1 zatvoren.