Cannot FTP to my NAS?

[jamesnb]

Hello
I have a TS-471 and a few shared folders created. I also enable FTP server, using the default port 21
I also create an user account and grant the FTP access.
On the other side, I have a MacBook Pro running CyberDuck FTP client software. I can use the CyberDuck on another NAS from a friend of mine, different brand though
But the CyberDuck keep saying the NAS is error on the connection and therefore, cannot connect?

Could anyone experience this problem give me some pointers please?

Thank you

[CylonCenturion]

Hello
I have a TS-471 and a few shared folders created. I also enable FTP server, using the default port 21
I also create an user account and grant the FTP access.
On the other side, I have a MacBook Pro running CyberDuck FTP client software. I can use the CyberDuck on another NAS from a friend of mine, different brand though
But the CyberDuck keep saying the NAS is error on the connection and therefore, cannot connect?

Could anyone experience this problem give me some pointers please?

Thank you

What credentials do you use to access the NAS by cyberduck?

[schumaku]

Connect to the NAS ftp server on the LAN, or from the Internet (another Internet connection), or from the LAN using the public IPv4 address (also by DNS name)?

Connect ftp or ftpes? If doing ftpes from the Internet, router FTP ALG can't deal with opening the FTP data ports because of the FTP control channel is encrypted.

Are the FTP passive data pots NAT-forwarded to the NAS LAN IP?

What is configured in the FTP Server Advanced settings?

Don't know of CyberDuck does offer a verbose connection log - if yes, provide a copy please. Otherwise, consider a test ride using Filezilla, right click into the log space, and enable "Show detailed log".

[jamesnb]

Hello
I have a TS-471 and a few shared folders created. I also enable FTP server, using the default port 21
I also create an user account and grant the FTP access.
On the other side, I have a MacBook Pro running CyberDuck FTP client software. I can use the CyberDuck on another NAS from a friend of mine, different brand though
But the CyberDuck keep saying the NAS is error on the connection and therefore, cannot connect?

Could anyone experience this problem give me some pointers please?

Thank you

What credentials do you use to access the NAS by cyberduck?

According to CyberDuck, I have the following:
I have put the dyndns account into the "Server" field. I have also forward the port 21 to my NAS
- Port: 21 (default)
- Username/Password: NAS-created username/password
- Connection mode: I have tried: default/passive/active - none is working
Am I missing anything in here?

[CylonCenturion]

Hello
I have a TS-471 and a few shared folders created. I also enable FTP server, using the default port 21
I also create an user account and grant the FTP access.
On the other side, I have a MacBook Pro running CyberDuck FTP client software. I can use the CyberDuck on another NAS from a friend of mine, different brand though
But the CyberDuck keep saying the NAS is error on the connection and therefore, cannot connect?

Could anyone experience this problem give me some pointers please?

Thank you

What credentials do you use to access the NAS by cyberduck?

According to CyberDuck, I have the following:

I have put the dyndns account into the "Server" field. I have also forward the port 21 to my NAS

When you access the NAS in your internal network you do not have to forward port 21 to the NAS.
It makes you potentially vulnerable for the ouside world.

You should put the NAS ip in the place where you put the dydns account
So serverfield should be like 192.XXX.XXX.XX

- Username/Password: NAS-created username/password

Perfect

- Connection mode: I have tried: default/passive/active - none is working

Transfermode should be on default, so no passive nor active.

Am I missing anything in here?

Disable the portforwading of port 21 to your TVS-471, unless one of your buddies wants access.

[hcezar]

Hello,

I have the same problem,

I have enabled the FTP server on my TS-469L on firmware 4.3.3.0154 but the ftp server doesn't start, ftp to NAS gives connection error, checking the netstat -a output on the NAS through SSH doesn't lists the port 21 as LISTENING.

any tip?

Kind regards

[schumaku]

Was you NAS updated to 4.3.3 recently, and FTP was up and running before? A good start would be to re-apply the same firmware image again and retest -> https://wiki.qnap.com/wiki/Manually_Updating_Firmware

Restart ftp:

[~] # /etc/init.d/ftp.sh restart
Shutting down FTP services: .OK
Starting FTP services: OK

Check for any suspect Kernel output ref. ftp or proftpd near to the last lines:

[~] # dmesg
...

Check if proftpd -t does issues something odd:

[~] # proftpd -t
Checking syntax of configuration file
2017-05-01 13:40:41,339 proftpd[31144]: QNAP SIGHUP signals installed
2017-05-01 13:40:41,339 proftpd[31144]: QNAP SIGUSR* signals installed
2017-05-01 13:40:41,344 TS-269L proftpd[31144]: Qgenetate_fifo_name(/share/.proftpd.fifo/confr-31160)
2017-05-01 13:40:41,344 TS-269L proftpd[31144]: Qgenetate_fifo_name(/share/.proftpd.fifo/confw-31160)
2017-05-01 13:40:41,344 TS-269L proftpd[31144]: Qgenetate_fifo_name(/share/.proftpd.fifo/rpcr-31160)
2017-05-01 13:40:41,345 TS-269L proftpd[31144]: Qgenetate_fifo_name(/share/.proftpd.fifo/rpcw-31160)
2017-05-01 13:40:41,356 TS-269L proftpd[31144]: NAS buf=guest name=guest
2017-05-01 13:40:41,383 TS-269L proftpd[31144] 10.10.1.137: mod_lang/1.0: unable to scan the localised files in '/usr/local/share/locale': No such file or directory
Syntax check complete.

What does proftpd -V show?

[~] # proftpd -V
Compile-time Settings:
Version: 1.3.5a (maint)
Platform: LINUX [Linux 3.4.6 x86_64]
Built: Thu Apr 13 2017 12:59:10 CST
Built With:
configure '--host=x86_64-QNAP-linux-gnu' '--sysconfdir=/etc/config' '--localstatedir=/var' '--with-libiconv=/root/daily_build/64_02/4.3.x/LinkFS/lib' '--with-modules=mod_tls' '--enable-auth-pam=no' '--enable-shadow' '--enable-sendfile' '--enable-nls' '--enable-openssl' '--enable-ipv6' '--with-includes=/root/daily_build/64_02/4.3.x/NasLib/include:/root/daily_build/64_02/4.3.x/NasLib/libnaspriv' '--disable-trace' '--enable-builtin-getaddrinfo' '--enable-pool-size=256' '--enable-buffer-size=1024' 'host_alias=x86_64-QNAP-linux-gnu' 'CC=x86_64-QNAP-linux-gnu-gcc' 'LDFLAGS=-L/root/daily_build/64_02/4.3.x/Model/TS-269/build/RootFS/usr/lib -L/root/daily_build/64_02/4.3.x/LinkFS/lib -L/root/daily_build/64_02/4.3.x/LinkFS/usr/lib -liconv -luLinux_NAS -luLinux_statistics -luLinux_config -luLinux_PDC -lattr -lacl -luLinux_naspriv -luLinux_Util -L/root/daily_build/64_02/4.3.x/Model/TS-269/build/RootFS/lib -lssl -lcrypt -lcrypto -luLinux_cgi -luLinux_Storage -luLinux_quota -luLinux_naslog -lsqlite3 -luLinux_hal -luLinux_ini' 'CPPFLAGS=-DCONFIG_ARCH_TS -I/root/daily_build/64_02/4.3.x/Kernel/linux-3.4.6/include -DQNAP_HAL_SUPPORT -I/root/daily_build/64_02/4.3.x/LinkFS/usr/include -I/root/daily_build/64_02/4.3.x/LinkFS/include -D_QNAP_ -DAPPLICATION_PRIVILEGE -DTS269 -D_PROJECT' 'CXX=x86_64-QNAP-linux-gnu-g++'

CFLAGS: -O2 -Wall
LDFLAGS: -L$(top_srcdir)/lib -L/root/daily_build/64_02/4.3.x/Model/TS-269/build/RootFS/usr/lib -L/root/daily_build/64_02/4.3.x/LinkFS/lib -L/root/daily_build/64_02/4.3.x/LinkFS/usr/lib -liconv -luLinux_NAS -luLinux_statistics -luLinux_config -luLinux_PDC -lattr -lacl -luLinux_naspriv -luLinux_Util -L/root/daily_build/64_02/4.3.x/Model/TS-269/build/RootFS/lib -lssl -lcrypt -lcrypto -luLinux_cgi -luLinux_Storage -luLinux_quota -luLinux_naslog -lsqlite3 -luLinux_hal -luLinux_ini
LIBS: -lssl -lcrypto -lssl -lcrypto -L$(top_srcdir)/lib/libcap -lcap -lssl -lcrypto -lsupp -ldl -liconv

Files:
Configuration File:
/etc/config/proftpd.conf
Pid File:
/var/proftpd.pid
Scoreboard File:
/var/proftpd.scoreboard

Features:
- Autoshadow support
- Controls support
- curses support
- Developer support
- DSO support
+ IPv6 support
+ Largefile support
- Lastlog support
- Memcache support
- ncurses support
+ NLS support
+ OpenSSL support
- PCRE support
- POSIX ACL support
+ Shadow file support
+ Sendfile support
- Trace support

Tunable Options:
PR_TUNABLE_BUFFER_SIZE = 1024
PR_TUNABLE_DEFAULT_RCVBUFSZ = 8192
PR_TUNABLE_DEFAULT_SNDBUFSZ = 8192
PR_TUNABLE_GLOBBING_MAX_MATCHES = 100000
PR_TUNABLE_GLOBBING_MAX_RECURSION = 8
PR_TUNABLE_HASH_TABLE_SIZE = 40
PR_TUNABLE_NEW_POOL_SIZE = 256
PR_TUNABLE_SCOREBOARD_BUFFER_SIZE = 80
PR_TUNABLE_SCOREBOARD_SCRUB_TIMER = 30
PR_TUNABLE_SELECT_TIMEOUT = 30
PR_TUNABLE_TIMEOUTIDENT = 10
PR_TUNABLE_TIMEOUTIDLE = 600
PR_TUNABLE_TIMEOUTLINGER = 30
PR_TUNABLE_TIMEOUTLOGIN = 300
PR_TUNABLE_TIMEOUTNOXFER = 300
PR_TUNABLE_TIMEOUTSTALLED = 3600
PR_TUNABLE_XFER_SCOREBOARD_UPDATES = 10

Check the /etc/config/uLinux.conf [FTP] section by editor, or by getcfg:

[~] # getcfg FTP ServerName
ProFTPD
[~] # getcfg FTP Enable
True
[~] # getcfg FTP Port
21
[~] # getcfg FTP MaxInstances
30
[~] # getcfg FTP User
guest
[~] # getcfg FTP Group
guest
[~] # getcfg FTP DefaultRoot
/share
[~] # getcfg FTP MaxAnonymous
30
[~] # getcfg FTP AllowAnonymous
False
[~] # getcfg FTP Unicode
1
[~] # getcfg FTP CharsetRemote
999
[~] # getcfg FTP "SSL MODE"
7
[~] # getcfg FTP "Passive Enabled"
1
[~] # getcfg FTP "Bandwidth Enabled"
0
[~] # getcfg FTP "Max connection per account"
10
[~] # getcfg FTP EnableUserWanIP
FALSE
[~] # getcfg FTP WanIP

[~] #

Guest account exists?

[~] # cat /etc/passwd | grep guest
guest65534:65534:guest:/share/homes/guest:/bin/sh
[~] # cat /etc/shadow | grep guest
guest:$1$$xxxxxxxxxxxxxxxxxxxxxx/0:99999:7:::

[hcezar]

Thanks Schumaku!!

my proftpd was assigned to the account 'ftp', which doesn't exists. Changing it to the account 'guest', which is present on my system, and restarting it from ftp.sh it now works.

[schumaku]

OK - QNAP always used guest for the FTP server base service ... it's even mandatory for SAMBA btw.

So we should add a check for the User and Group to the test process:

[~] # cat /etc/config/proftpd.conf
ServerName "ProFTPD"
ServerType standalone
DefaultServer on
RootLogin on
Port 21
MaxInstances 30
User guest
Group guest
DefaultRoot "/share"
...

[jamesnb]

I have contacted the customer service and one of the support engineer was able to help me trouble-shooting it. What she was re-install the firmware and also, enabled the "Port Range" instead of using the "default port range" (you can change it back after). However, I also need to forward a port range in my Router to the NAS (my NAS is behind the Router) and voila, it works.
I guess it is a mix of corrupted firmware or something...
I can now FTP using web-browser or using client software, accessing my NAS from outside of the home LAN

P.S. Port 21 does not work for me for some reason. I changed this port to something else.

[schumaku]

What she was re-install the firmware and also, enabled the "Port Range" instead of using the "default port range" (you can change it back after).

Using another passive ftp port range cna be required of the port(s) are already in use on the router by manual or UPnP PMP port forwardings. Changing it back might not a good idea, as it appears nobody knows the details.

I also need to forward a port range in my Router to the NAS (my NAS is behind the Router) and voila, it works.

Routers with an FTP ALG might be able to handle the port-forwarding dynamically at least as long as the FTP ALG can read the insecure FTP control connection. For using FTPES, the passive port range _must_ be manually port forwarded in any case.

P.S. Port 21 does not work for me for some reason. I changed this port to something else.

This does almost certainly kill the router's FTP ALG - because these FTP ALG do listen on the default FTP control port 21/TCP only. Some (very few...) routers allow to reconfigure the FTP ALG, or add a secondary port number to be monitored by the FTP ALG.

I can now FTP using web-browser or using client software, accessing my NAS from outside of the home LAN

These FTP ALG are becoming more and more obsolete, as using plain text FTP (as used by any browser....) is a bad idea in the year 2017. Strongly suggest to configure the FTP client software to use FTPES, and avoid plain text FTP ie. Web browser FTP access.

[mambino]

I am having this problem now. My FTP used to work but now I am far away from my NAS and this is becoming a large problem for me

I can access my nas through xxx.myqnapcloud.com via browser with qnapcloud link service no problem

However FTP does not work
Resolving address of xxx.myqnapcloud.com
Then it says connecting to.... (my ip)

But then
Error: Connection timed out after 20 seconds of inactivity
Error: Could not connect to server

Browser connection works but I cannot get any response from FTP?

I have checked all my router settings, using as asus router. Ports 20.21 forwarded
Also set passive ftp port range in QNAP settings and forwarded those in my router as well....

Any help is appreciated

[Bob Zelin]

Hi Mambino -
this is a guess.
This "used to work". Your ASUS router must be the only router in your system. IF there is another router from your internet service provider in front of the ASUS, this is called a "Double NAT". This means that even though
the ASUS port forwarding for port 21 is correct, and you can see in MyQnapCloud that everything is ok with the port forwarding (no errors on port 21) - you still cannot remote access it, because the other router is blocking
the port forwarding.

It is common for a cable internet provider to give you a "box" - like an Arris router. People will purchase their own router, and plug the cable company box into their router (like your ASUS) and they say "I cannot get remote access".
This applies to all kinds of things like FTP, HBS3 remote, and QVPN. If that other "box" is a router, and it is not set to Bridged Mode (so that it does not use any of the routing functions) - this will cause your problem.

The typical reaction is - "but I can get internet access, I can get WiFi, I can get CloudLink to all work - but just not FTP" - it's because another box (like the cable company box) is blocking those ports.

Bob Zelin

[mambino]

Hi Mambino -
this is a guess.
This "used to work". Your ASUS router must be the only router in your system. IF there is another router from your internet service provider in front of the ASUS, this is called a "Double NAT". This means that even though
the ASUS port forwarding for port 21 is correct, and you can see in MyQnapCloud that everything is ok with the port forwarding (no errors on port 21) - you still cannot remote access it, because the other router is blocking
the port forwarding.

It is common for a cable internet provider to give you a "box" - like an Arris router. People will purchase their own router, and plug the cable company box into their router (like your ASUS) and they say "I cannot get remote access".
This applies to all kinds of things like FTP, HBS3 remote, and QVPN. If that other "box" is a router, and it is not set to Bridged Mode (so that it does not use any of the routing functions) - this will cause your problem.

The typical reaction is - "but I can get internet access, I can get WiFi, I can get CloudLink to all work - but just not FTP" - it's because another box (like the cable company box) is blocking those ports.

Bob Zelin

Thank you Bob! I think that must be the problem.

So what I need to do is call my ISP and figure out how to turn their cable company box to bridged mode, correct?

Is there anything else I should look to do as well?

Thanks

[Bob Zelin]

is there anything else - yes - prepare to be speaking with idiots at your ISP. "What is bridged mode - what is port forwarding" - they will have no clue. I do this
constantly for people, and I still fail about 25% of the time, because of lack of cooperation from different ISP providers.
Bob Zelin