Brume 3, running 4.9 updated firmware last Saturday. Client cameras can no longer FTP to a godaddy server. As usual they are not all that helpful with the reason but, a dos command window on a laptop vpn’d to that lan via wireguard cannot ftp to the godaddy account either. That recieves
”current restricted directory is /”
”ls -l”
”500 I won’t open a connection to ipaddr (only to ipaddr of home lan hosting the vpn”
”550 can’t check for file existence”
All of this used to work in the prior release.
More over, in spite of having creating a host list the client IP addresses seem to be random when the router is booted.
So what am I missing with this upgrade to 4.9?
Even though we are out of country I am ready to punt 4.9 and go back to a prior release.
so from my understanding you have a ftp server on godaddy(?), and you try reach this ftp server via a wireguard tunnel?
But the godaddy server is not local or is it from the tunnel ? And is this a webhosting or a dedicated server ?
The only change in the firmware is that portforwards may are broken they have been moved to a /etc/config/portforwarding to track it internally by scripts, I would suggest to look them up in luci and check if they are still enabled or re-create them in the gl ui and remove the old rules.
^ i did not experience failure only a lost of visibility in the gl ui, but there are some reports about this.
Godaddy is not local and is webhosting. Interestingly enough, if I start filezilla on the laptop that cannot ftp from a command prompt beyond logon as indicated above, I can list the directories and download the files on the godaddy ftp server using filezilla.
Ok I found that FTP is enabled and forwarded to the ip of the router hosting the VPN. I am wondering if that means they go to the router and stop there without heading out the tunnel/vpn to the internet?
Edit:
Clients can ftp to a lan local raspberry mounted drive.
If the ftp server is on a webhosting and publically accessible, there is not really a need for portforwarding here.
Does the ftp client work without tunnel?, and fail with tunnel?
If the ftp is unreachable inside the vpn tunnel maybe adjust the mtu and set it lower, minimum 1280 and max 1420 what is the endpoint ip is that a external vpn such as mullvad or a different one?
It is possible that godaddy blocks known vpns, for me that is not really a surprise given how many hosts I have seen having compromises, but also the amount of abuse in general by bad actors in the past within this hosting provider.
Also a note:
Sometimes they can limit the amount of connections, I'm not sure how windows cmd ftp handles this and if connections are configurable, if in question try to always set it to a single connection when failure happens, filezilla does have a option for this but by default it uses 4 connections.
Some good ideas. Again, I can use Filezilla from the laptop that a dos command prompt will not allow an ftp connection to list directories etc.. I can look into the other aspects and see if they have an impact.
We have to catch a flight so I will be out of here for at least 12 hours. Thank you for the insight!
I will try to clarify the scenario.
I am remote on a laptop accessing the home lan through a wireguard vpn tunnel hosted by that home lan. On this remote laptop I can use Filezilla to access a remote (to the home lan) godaddy server. Filezilla can access and list the directory contents on the godaddy server. On this same remote laptop if I open a dos command promt and open an ftp connection to the remote godaddy server I receive the following response to the “ls” command;
”500 I won’t open a connection to 10.1.0.2 (only to x.y.x.w)”
”425 no data connection”
It is as though the connection to the tunnel is not allowed when using the dos initiated ftp request but it is allowed if initiated by filezilla.
Tunnel Address 10.1.0.1/24
This was working fine before I installed 4.9.
I am using the dos ftp approach to trouble shoot a camera on the home lab that cannot load an image to a website but was quite happy to prior to installing 4.9.
Edits:
Moral: Never update software before leaving town. Obviously I will not turn off the tunnel to experiment as I will not be able to access the home lan.
Both the camera and Filezilla are using port 21, same target user, directory etc..
I believe I was able to resolve this. I added a Security→Port Forward entry from Wireguard Server to the IP address of my camera PORT 21 and deleted the LUCI→Network→Port Forwards entry for port 21.
The camera succesfully updates the webpage now. I did not delete the Port Forward from Security and retest without that as well. Not sure if it requires the combination of the new rule and deletion of the old one or merely the deletion of the old one using Luci.
I can retest some time soon.
Your suggestion was spot on, Thank you.
It was not necessary to add Secuirty→Port Forwarding→Wireguard, external, internal port 21, and ip address. So merely deleting the Firewall port forward entry did the trick. I have deleted the Security port forwarding and rebooted as well. NTF now.
Thanks again!
Edit: Dos ftp to the same site cannot open a data connection. I was able to change directory though. This seems to be a limitation of the basic windows ftp program.