2

I have been at this a few times and have become completely stuck in configuring this. Currently, I have this set up for an FTP server:

Local PC (My MAC) -> AWS EC2 (HaProxy) -> FTP Server

Here's a few things I have done so far:

  1. Confirmed Ports 20/21 are open in Security Groups
  2. Configured in SGs that TCP ports are opened (for passive ports).
  3. Confirmed via netstat that the appropriate ports are opened ( as a sanity check, I got HaProxy to bind to 0-65535 TCP ports (same for SGs).
  4. Ran TCPDump while trying to connect to the FTP server via the proxy

Here is a copy of my haproxy.cfg

listen FTP :21, :10000-10250
        mode tcp
        log 127.0.0.1 local0 debug info warning error
        bind *:21
        bind *:20
        server foo xx.xx.xx.xx:21 check port 21

When I run tcpdump, I get:

10:54:11.695983 IP 10.33.x.x.56374 > ec2-54-234-x-x.compute-1.amazonaws.com.ftp: Flags [P.], seq 45:51, ack 684, win 16384, options [nop,nop,TS val 652929632 ecr 148377527], length 6: FTP: EPSV
10:54:11.726462 IP ec2-54-234-x-x.compute-1.amazonaws.com.ftp > 10.33.x.x.56374: Flags [P.], seq 684:726, ack 51, win 227, options [nop,nop,TS val 148377680 ecr 652929632], length 42: FTP: 229 Extended Passive mode OK (|||12612|)
10:54:11.726513 IP 10.33.x.x.56374 > ec2-54-234-x-x.compute-1.amazonaws.com.ftp: Flags [.], ack 726, win 16378, options [nop,nop,TS val 652929662 ecr 148377680], length 0
10:55:27.134823 IP 10.33.x.x.56374 > ec2-54-234-x-x.compute-1.amazonaws.com.ftp: Flags [P.], seq 51:80, ack 726, win 16384, options [nop,nop,TS val 653004663 ecr 148377680], length 29: FTP: EPRT |1|10.33.x.x|56397|
10:55:27.165241 IP ec2-54-234-x-x.compute-1.amazonaws.com.ftp > 10.33.x.x.56374: Flags [P.], seq 726:798, ack 80, win 227, options [nop,nop,TS val 148396540 ecr 653004663], length 72: FTP: 500 I won't open a connection to 50.232.x.x (only to 54.234.x.x)
10:55:27.165287 IP 10.33.x.x.56374 > ec2-54-234-x-x.compute-1.amazonaws.com.ftp: Flags [.], ack 798, win 16375, options [nop,nop,TS val 653004693 ecr 148396540], length 0
10:55:27.165377 IP 10.33.x.x.56374 > ec2-54-234-x-x.compute-1.amazonaws.com.ftp: Flags [P.], seq 80:106, ack 798, win 16384, options [nop,nop,TS val 653004693 ecr 148396540], length 26: FTP: PORT 10,33,x,x,220,77
10:55:27.194982 IP ec2-54-234-x-x.compute-1.amazonaws.com.ftp > 10.33.x.x.56374: Flags [P.], seq 798:870, ack 106, win 227, options [nop,nop,TS val 148396547 ecr 653004693], length 72: FTP: 500 I won't open a connection to 50.232.x.x (only to 54.234.x.x)
10:55:27.195025 IP 10.33.x.x.56374 > ec2-54-234-x-x.compute-1.amazonaws.com.ftp: Flags [.], ack 870, win 16375, options [nop,nop,TS val 653004722 ecr 148396547], length 0
10:55:27.195304 IP 10.33.x.x.56374 > ec2-54-234-x-x.compute-1.amazonaws.com.ftp: Flags [P.], seq 106:112, ack 870, win 16384, options [nop,nop,TS val 653004722 ecr 148396547], length 6: FTP: LIST
10:55:27.224432 IP ec2-54-234-x-x.compute-1.amazonaws.com.ftp > 10.33.x.x.56374: Flags [P.], seq 870:894, ack 112, win 227, options [nop,nop,TS val 148396555 ecr 653004722], length 24: FTP: 425 No data connection
10:55:27.224464 IP 10.33.x.x.56374 > ec2-54-234-x-x.compute-1.amazonaws.com.ftp: Flags [.], ack 894, win 16381, options [nop,nop,TS val 653004751 ecr 148396555], length 0

I configured logging on HaProxy and currently have this (not sure if this is helpful):

Jun 12 14:49:25 localhost haproxy[18805]: 50.232.x.x:14857 [12/Jun/2017:14:48:24.811] FTP FTP/media 1/14/60772 792 -- 0/0/0/0/0 0/0
Jun 12 14:49:25 localhost haproxy[18805]: 50.232.x.x:14857 [12/Jun/2017:14:48:24.811] FTP FTP/media 1/14/60772 792 -- 0/0/0/0/0 0/0
Jun 12 14:51:48 localhost haproxy[18805]: 50.232.x.x:56254 [12/Jun/2017:14:49:41.820] FTP FTP/media 1/13/127012 960 -- 0/0/0/0/0 0/0
Jun 12 14:51:48 localhost haproxy[18805]: 50.232.x.x:56254 [12/Jun/2017:14:49:41.820] FTP FTP/media 1/13/127012 960 -- 0/0/0/0/0 0/0
Jun 12 14:52:02 localhost haproxy[18805]: 50.232.x.x:56342 [12/Jun/2017:14:51:54.618] FTP FTP/media 1/14/7670 401 -- 1/1/1/1/0 0/0
Jun 12 14:52:02 localhost haproxy[18805]: 50.232.x.x:56342 [12/Jun/2017:14:51:54.618] FTP FTP/media 1/14/7670 401 -- 1/1/1/1/0 0/0
Jun 12 14:53:36 localhost haproxy[18805]: 50.232.x.x:56345 [12/Jun/2017:14:51:59.386] FTP FTP/media 1/19/97481 1032 -- 0/0/0/0/0 0/0
Jun 12 14:53:36 localhost haproxy[18805]: 50.232.x.x:56345 [12/Jun/2017:14:51:59.386] FTP FTP/media 1/19/97481 1032 -- 0/0/0/0/0 0/0
Jun 12 14:53:59 localhost haproxy[18805]: 50.232.x.x:56373 [12/Jun/2017:14:53:37.880] FTP FTP/media 1/14/21641 333 -- 0/0/0/0/0 0/0
Jun 12 14:53:59 localhost haproxy[18805]: 50.232.x.x:56373 [12/Jun/2017:14:53:37.880] FTP FTP/media 1/14/21641 333 -- 0/0/0/0/0 0/0

I can connect to the FTP Server and cd to directories. I cannot run an ls/put/get on there though. When I try on passive mode, I get: 

ftp> ls
229 Extended Passive mode OK (|||12612|)
ftp: Can't connect to `54.234.x.x': Operation timed out
500 I won't open a connection to 50.232.x.x (only to 54.234.x.x)
425 No data connection

Running on Active mode:

Passive mode: off; fallback to active mode: off.
ftp> ls
500 I won't open a connection to 50.232.x.x (only to 54.234.x.x)
425 No data connection

I don't believe this to be an issue particularly with the FTP servers only because I can connect to it via the proxy. Even when I connect to the FTP servers directly, I can run commands on active and passive mode. My questions are:

  • What else can I look into that can further troubleshoot this?
  • Is there any further logging configurations I can do that would enhance logging for any kind of TCP requests other than what I currently have?
  • Is there something configuration wise I am missing in HaProxy (I know that natively HaProxy is an HTTP load balancer but I looked up enough examples where I can configure it to be used as a proxy for FTP servers and I cannot reconfigure the FTP servers to be ran as SFTP)?
Jeff Schaller
  • 66,199
  • 35
  • 114
  • 250
ryekayo
  • 4,705
  • 9
  • 41
  • 66

2 Answers2

2

After much research and some investigation with my colleague on this, this is what was happening:

  • HaProxy could have been a viable solution. But, the FTP server is configured to force passive mode. HaProxy can be used to proxy FTP connections but there is no real way to configure it to react accordingly to Passive connections. As a result, I was unable to run the ls/get/put (and probably even more) commands!

My Solution was to go to ftp-proxy and configure it. Once I configured ftp-proxy to route traffic to the FTP server (while configuring it to listen to passive connnections), VIOLA! It worked!!

ryekayo
  • 4,705
  • 9
  • 41
  • 66
  • 1
    *"I dont believe this to be an issue particularly with the FTP servers only because I can connect to it via the proxy."* Now you know... that's exactly what is is. FTP is a ridiculous protocol on the wire, and relatively difficult to proxy sanely (compared to most TCP protocols, which largely just work). HAProxy, amazing as it is, doesn't implement the necessary FTP nonsense to proxy FTP, passive or not. SFTP, by contrast, is entirely straightforward, since it's not just "S"+FTP but an entirely different protocol. – Michael - sqlbot Jun 13 '17 at 03:04
  • Agreed! I wish I can flip it over to SFTP, but these are production machines. I am glad i was able to figure this out, i thought i was going crazy lol – ryekayo Jun 13 '17 at 10:02
0

I am also trying to do the same thing but the ls command is failing. Below is what I have configured in HA Proxy. listen xmldb 10.204.24.71:2100 server xmldb1 10.212.22.31:2100 check inter 20s server xmldb2 10.212.22.36:2100 check inter 20s

10.212.22.36 and 10.212.22.31 are the DB server where the ftp server is running. and they are only reachable from 10.204.24.71 server where the HA proxy is running.

Now i connecting from other linux machine which is not reachable to DB server but can reach the HA Proxy Server.

Do i need to put some more configuration to make it work.

Gaurav Mittal
  • 1
  • 3
  • You realize the default FTP port is 21, not 2100? Thats part of the issue. And also, you dont need to add the HA proxy's server IP in to your configuration since you dont have FTP running on it. – ryekayo Jun 28 '17 at 10:06
  • Thanks a lot Sir for the reply. Below is the configuration for the HA Proxy as per your recommendation. listen FTP :21 mode tcp bind *:21 server ftp-serv00 10.212.22.31:21 check port 21 – Gaurav Mittal Jun 28 '17 at 12:42
  • Based on the configuration when I start the HAPROXY i get the error as:slamd@BL6-QA-LT71:~/haproxy$ ./haproxy-1.4.18-solaris10-x86.stripped -f HDMAdminGUI.cfg [ALERT] 178/181641 (3520) : Starting proxy FTP: cannot bind socket [ALERT] 178/181641 (3520) : Starting proxy FTP: cannot bind socket slamd@BL6-QA-LT71:~/haproxy$ – Gaurav Mittal Jun 28 '17 at 12:44
  • Check netstat and see if there are any other ports binded to 21 – ryekayo Jun 28 '17 at 12:45
  • Nothing is there. slamd@BL6-QA-LT71:~/haproxy$ netstat -nua | grep 21 stream-ord airvana 1476 nautilus /var/tmp/orbit-airvana/linc-5c4-0-58d93bda92172 stream-ord airvana 1461 gconfd-2 /var/tmp/orbit-airvana/linc-5c4-0-58d93bda92172 stream-ord airvana 1476 nautilus /var/tmp/orbit-airvana/linc-5c4-0-58d93bda92172 slamd@BL6-QA-LT71:~/haproxy$ – Gaurav Mittal Jun 28 '17 at 12:53
  • THis HAPRoxy is running on Oracle Solaris 11.3 X86 – Gaurav Mittal Jun 28 '17 at 12:54
  • Perhaps you should ask a question on this site.. Your "answer" is not providing an answer to the original question posted here. It is asking a separate question. – ryekayo Jun 28 '17 at 13:00