If you host an FTP server behind your Firebox device that supports passive mode (PASV) connections, make sure that the PASV-response IP address matches the interface IP address of the server. This issue also applies to inbound FTP packet filters with SNAT. This is unnecessary as the FTP proxy on your Firebox translates the PASV responses to the external IP address, and adds rules for the additional data ports specified in the PASV response. Some FTP server configurations will respond with the external gateway IP address for the network.

For information on the TCP/UDP proxy, see About the TCP-UDP-Proxy.įor detailed instructions on how to add the FTP-proxy to your Firebox configuration, see Add a Proxy Policy to Your Configuration. When FTP uses a port other than port 20, the TCP/UDP proxy relays the traffic to the FTP-proxy. The TCP/UDP proxy is available for protocols on non-standard ports. For a policy that handles traffic to servers on your network from external users, use the FTP-Server action. For a policy that handles traffic from your network to external hosts, use the FTP-Client action. When you configure the FTP Proxy, make sure to choose the correct Proxy Action for the policy. WatchGuard recommends you use FTP-Proxy policies for any FTP traffic between your network and external hosts, or from external users to an FTP server on your network.

How to read filezilla logs passive ftp