Problems with FTP in conjunction with VPN

What is active/passive FTP

First, FTP establishes control connection (from now on CC) from the client to the server. Then, for each file that is transferred, a file transfer connection (from now on FC) is established. The difference between active and passive FTP is how the FC is created.

Active FTP

First, a CC from a port greater than 1024 on the client to port 21 on the server is established. The client listens for a FC on a port greater than 1024 and notifies the server about this via the CC. The server establishes a FC from port 20 to the client's port.

Client Server
p>1024 to p=21 (CC)
p>>1024 from p=20 (FC)

Passive FTP

The CC is established the same way as in active FTP. The server establishes a port greater than 1024 and notifies the client via the CC. The client establishes a FC from a port over 1024 to the port that the server listens to. Port 20 on the server is not used.

Client Server
p>1024 to p=21 (CC)
p>1024 to p>1024 (FC)

How does Cisco VPN work

VPN establishes en encrypted TCP- or UDP-connection to the VPN-concentrator, which assigns the VPN-client an IP-address. Then VPN puts itself in the protocol stack to the network card.

The only network connection that works after this is the VPN-connection. Packets from other connections will be discarded. All outgoing packets are encrypted and sent through the VPN-connection to the VPN-concentrator.

The VPN-concentrator decrypts and changes the headers in the packets to make it look like the packets come from the VPN IP-address assigned by the concentrator. The recipient of the packets will send packets back to the VPN IP-address. The VPN-concentrator encrypts, assembles and sends the packages back to the client which owns the IP-address through the VPN-connection. VPN at the client disassembles, decrypts and changes the headers in the packets to make it look like the packets was meant for the client that runs VPN.

In other words, programs running on the client can only see the network card's IP, not the IP assigned by the VPN-concentrator.

All connections from other machines to the VPN IP-address will be established through the VPN-connection to the client. All connections directly to the client's network card IP-address will fail because the VPN-connection is the only working network connection on the client.

The problem with VPN and FTP (and other similar protocols)

When you use VPN the CC will always work. The problem is the FC. Packets sent over the CC with information about which port the client/server listens to will also contain the local IP-address for the network card the client/server listens to.

Programs running on the client only knows the local IP-address, not the VPN IP-address. This makes the programs (e.g. FTP) report "wrong" IP-address. The VPN-concentrator will only changes the packet headers, not the contents in the packets.

Example:

-The FTP-server is not running VPN.
-The FTP-client is running VPN.
-The FTP-client wants to try active FTP.
-The FTP-client has IP-address 80.80.80.80 and is assigned VPN IP-address 90.90.90.90

The FTP-client establishes a CC from a port greater than 1024 to the FTP-server's port 21.
The FTP-client transmits a message that it is listening on a port greater than 1024 for FC and its local IP-address, which is 80.80.80.80
The FTP-server tries to establsih a FC from port 20 to the clients port greater than 1024 on IP-address 80.80.80.80
But VPN will stop all connections to 80.80.80.80 because the VPN IP-address is 90.90.90.90, and a FC can't be established.

You have to use passive FTP.

End of example.

This problem also occurs in other protocols where IP-addresses are reported in the contents of the packets instead of the header.

Solutions

If the FTP-client is running VPN and the FTP-server is not, you have to use passive FTP. If the FTP-server is running VPN and the FTP-client is not, you have to use active FTP. If both are running VPN then FTP won't work. Read more about passive FTP .

An alternative way to solve this is to use SFTP ( FTP over an (SSL) encrypted tunnel).

Some versions of Mirablilis ICQ has this problem. A solution is to choose "use external ip" in the options.