# FTP - can't list directories when firewall on



## bryn1u (Mar 16, 2017)

Hello guys,

I have a really strange issue. When I turn on a firewall I'm not able to list user directories using FileZilla but when I turn off then will work. I'm using pure-ftpd.

My complicated pf.conf

```
# connected to internet
ext_if = "em0"

# block quick from <bruteforce>
 block in all
 block return

# keep stats of outgoing connections
 pass out keep state

# unlimited traffic  for loopback and lan / vpn
 set skip on {lo0, lo1}

 pass in on $ext_if proto tcp from any to any port { 20,21,22,53,80 }
```

I'm getting an error:

```
Status:   Connecting to 91.121.X.X:21...
Status:   Connection established, waiting for welcome message...
Status:   Insecure server, it does not support FTP over TLS.
Status:   Logged in
Status:   Retrieving directory listing...
Command:   PWD
Response:   257 "/" is your current location
Command:   TYPE I
Response:   200 TYPE is now 8-bit binary
Command:   PASV
Response:   227 Entering Passive Mode (91,121,X,X,26,214)
Command:   MLSD
Error:   The data connection could not be established: ECONNREFUSED - Connection refused by server
```

There is no passive connection.

Someone can tell me what's going on?


----------



## SirDice (Mar 16, 2017)

FTP creates a data channel on a randomly chosen port. This makes it notoriously tricky to firewall. This explains the issue rather good: http://www.slacksite.com/other/ftp.html

You can make PF aware of that by using ftp-proxy(8). But if you can, I would recommend dropping FTP and use SFTP.  Which is basically FTP over an SSH tunnel.


----------



## bryn1u (Mar 16, 2017)

Will not SFTP slower then FTP during files transfer ?


----------



## SirDice (Mar 17, 2017)

Not with descent hardware. It may be marginally slower but you gain a lot of security.


----------

