This guide show how to configure the Anybus Defender Compact with Netwrok Address Translation to allow FTP to pass through, both Active and Passive modes.
Background: the FTP protocol will typically start the session on port 21, but with after initiation the protocol will then decide higher tcp ports where the actual file transfer is happening. For Passive FTP the Client decides the ports, for Active FTP the Server decides the ports. For both cases the firewall must dynamically open the ports that were negotiated. For Active FTP the FTP negotiation message needs to be alternated for network address translation as well. For the firewall rules where you want to allow FTP you need to therefor set a "FTP-Helper" flag in the configuration.
APPLICABLE PRODUCTS
Anybus Defender Compact (ABD1004-NATFW)
VERSIONS USED IN THIS ARTICLE
- Anybus Defender Compact Firmware 1.4.1
- Anybus Defender Compact Manager 1.2.8
PRE-REQUISITES
To demonstrate this you must have an FTP server on the LAN network - in this example FileZilla Server is installed.
Anybus Defender Compact Manager is protecting the FTP server on the LAN side and the client who wants to connect is on the WAN side. See diagram.
Setting up FTP Proxy in Anybus Defender Compact Manager Configuration
This section provides information how the Anybus Defender Compact is configured in the Manager application:
Make sure to be in Gateway Mode.
Give the WAN and LAN Interfaces the IP you want them to have. In this case the client is on the WAN side and the server on the LAN side.
Configure Netwrok Address Translation with Simple NAT, the WAN address to be the Defender WAN interface OR an empty IP on that subnet, and the LAN IP address the server IP of the FTP Server.
Make sure WAN to LAN is Active.
Press the + to add a new row, the WAN IP Adress should be unique, and the LAN IP Adress should be the same as the servers, make sure to activate it.
Decline everything, except filter rules (recommended) should be the default.
Firewall Rules
Next the firewall rules need to be configured to allow traffic through to the FTP server.
Go to "Packet filter" -> Rules
In WAN > LAN you should see a rule that was automatically created when you made the SNAT.
Change None under Options to FTP-HELPER.
And make sure to activate it.
Upload the project to the Compact.
This setup will work both for Active & Passive Mode FTP server.
For testing: Configure FileZilla Server
This section provides optional information on how to configure the FileZilla server
Connect to Server.
Write the details of the server you created.
Server -> Configure
Here you can choose the Port(s) you want the server to listen to. Change Protocol to: Explicit FTP over TLS and insecure plain FTP.
Go to User under Right management and create a new user by pressing Add and name it. Choose the Authentication type you want; none, password or system credentials. Under Mount points, in Native path write the path that exists locally, then in Virtual path write what path you want it to be when using FTP, example: /Desktop or /Documents/Files. Add more paths by pressing Add.
Under Mount options choose the permissions for each path, one could be Read + Write while another could be Read only.
If you want to use Passive mode, go to FTP and FTP over TLS (FTPS) then press the Passive mode tab, here you can use a custom port range for Passive mode, just check the Use custom port range.