Project

General

Profile

Actions
Copy link

Bug #2650

closed

FTP helper breaks TCP sequence numbers on 2nd WAN

Added by Anonymous over 11 years ago. Updated almost 9 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Chris Buechler
Category:
-
Target version:
-
Start date:
10/01/2012
Due date:
% Done:

0%

Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
All
Affected Architecture:

Description

I am running a dual WAN setup. WAN1 is type WAN and is the default WAN, while WAN2 is type OPT. I have a FTP server on the LAN. For this FTP server I have set up port forwards for port 21 on each of the 2 WANs, relying on the built-in FTP helper to translate the control messages.

In this setup, a client connecting from the Internet via WAN1 IP + port 21 works as expected. A client connecting from the Internet via WAN2 IP + port 21 is able to authenticate, but once the PASV command is sent by the client, the TCP stream for port 21 breaks on the WAN2 side resulting in lots of TCP retransmissions and TCP session termination. This is the fault of the pfSense box that skips a sequence number when rewriting the packets received on the LAN interface towards the WAN2 interface.

Once WAN1 goes down, a client connecting from the Internet via WAN2 IP + port 21 works as expected.

I can reproduce this problem 100% of the time.

Actions
Copy link

Also available in: Atom PDF