Sftpgo/ftp passive communications fails but vsftpd works fine

[terabytesw]

Hi there ..
Hoping for at little help here. I have a clean ubuntu 22.04 installation with opened ports via iptables for 20, 21, 50000-50100.
A clean install of sftpgo (SFTPGo 2.5.5) with activated ftp on port 21 with passive port range 50000-50100 doesn't work. It stops at "Entering passive mode", gets a timeout and then closes the connection. I tried both WinScp and FileZilla clients and commandline.
I then tried a vsftpd install with the same port configuration and that works fine.

This is the logging from WinScp:

. 2023-12-21 14:02:04.983 Read 50 bytes
< 2023-12-21 14:02:04.983 227 Entering Passive Mode (xxx,xx,xx,xx,xxx,xx)
2023-12-21 14:02:04.983 MLSD
. 2023-12-21 14:02:04.983 Connecting to xxx.xx.xx.xx:50059 ...
. 2023-12-21 14:02:04.983 Connection pending
. 2023-12-21 14:02:19.579 Timeout detected. (data connection)
. 2023-12-21 14:02:19.579 Data connection failed
. 2023-12-21 14:02:19.579 Connection closed

iptables configuration is working fine with vsftpd.
sftpgo user exists and sftpgo folder and data folder and subfolders has correct permissions.
force_passive_ip is set correctly to external ip.
sftpgo binary has cap_net_bind_service.
no other service is listening on port 21 (I stopped vsftpd)

If I switch the sftpgo.json to listen on port 24 it works fine.
If I force the client to use active mode it works on port 21.

What could be the problem?
Thanks in advance

[drakkan]

Take a look to the SFTPGo logs and compare the working and non-working scenario

[terabytesw]

Hi @drakkan .. thx for the reply and efforts ..

I already did check the logs .. the log says:

Dec 21 14:16:05 ubuntu sftpgo[9984]: {"level":"debug","time":"2023-12-21T14:16:05.654","sender":"ftpserverlib","server_id":"FTP_0","clientId":"30","line":"227 Entering Passive Mode (xxx,xx,xx,xx,xxx,161)","message":"Sending answer"}
Dec 21 14:16:05 ubuntu sftpgo[9984]: {"level":"debug","time":"2023-12-21T14:16:05.665","sender":"ftpserverlib","server_id":"FTP_0","clientId":"30","line":"MLSD","message":"Received line"}
Dec 21 14:16:25 ubuntu sftpgo[9984]: {"level":"warn","time":"2023-12-21T14:16:25.666","sender":"ftpserverlib","server_id":"FTP_0","clientId":"30","error":"accept tcp [::]:50081: i/o timeout","message":"Unable to open transfer"}
Dec 21 14:16:25 ubuntu sftpgo[9984]: {"level":"debug","time":"2023-12-21T14:16:25.666","sender":"ftpserverlib","server_id":"FTP_0","clientId":"30","line":"425 accept tcp [::]:50081: i/o timeout","message":"Sending answer"}
Dec 21 14:16:32 ubuntu sftpgo[9984]: {"level":"debug","time":"2023-12-21T14:16:32.003","sender":"ftpserverlib","server_id":"FTP_0","clientId":"30","clean":"false","message":"Client disconnected"}
Dec 21 14:16:32 ubuntu sftpgo[9984]: {"level":"debug","time":"2023-12-21T14:16:32.003","sender":"FTP","connection_id":"FTP_0_30","message":"connection removed, local address "192.168.100.199:21", remote address "xxx.xx.xxx.xxx:53162" close fs error: , num open connections: 0"}
Dec 21 14:16:32 ubuntu sftpgo[9984]: {"level":"debug","time":"2023-12-21T14:16:32.003","sender":"ftpserverlib","server_id":"FTP_0","clientId":"30","clientIp":"xxx.xx.xxx.xxx:53162","message":"Client disconnected"}
Dec 21 14:16:32 ubuntu sftpgo[9984]: {"level":"debug","time":"2023-12-21T14:16:32.003","sender":"ftpserverlib","server_id":"FTP_0","clientId":"30","message":"Transfer connection closed"}

And when it works (on f.x. port 24) it doesn't throw the "transfer error"

[drakkan]

accept tcp [::]:50081: i/o timeout","message":"Unable to open transfer"

means the client did not connect to port 50081. I have a suspicion, but if so you should have the same error on port 24 too. I don't have the time/motivation for further help, sorry. Good luck with your project

[terabytesw]

I just discovered that it works when using the client in Extended Passive mode and not normal passive mode.

[terabytesw]

Ok problem solved. This vps is behind a router and has an 192.168 ip adress. I would presume that setting the force_passive_ip was required. But actually it didn't work when setting that ip. Leaving force_passive_ip empty got everything working.

Thanks for your time.