Sagemcom 5866T FTP over TLS problem

[patins01]

Just got this modem , but trying to use FTP over TLS alias FTPS (which is the default of Firezilla) doesnt work, getting this message:

"This server does not support FTP over TLS. If you continue, your passwords and files  will be send  in clear over the internet."

As I want a secure FTP connection, I cannot proceed here - how can I configure it in the modem configuration. Is this modem to old to support FTPS?

[david64]

Hi @patins01 . Is there a setting in Sagemcom for Application Level Gateway? Are the "FTP" options enabled?

Is this file server one that has worked in the past with a NBN connection and different router?

[patins01]

Using my amaysim network it works just fine as usual. I do not see FTP or TLS settings in the Sagemcom's configuration app, I went through every section in there. any ideas what else I can examine? 

[david64]

@patins01 . So, your Filezilla is using FTPS. Is it configured for Active or Passive mode?

Active mode requires the ftp server to connect in to your client. This may be blocked by CG-NAT used on 5G wireless broadband.

Passive mode means the client connects out on both ports and avoids firewall problems.

[patins01]

Hi David,

I am not sure about active/passive mode. I used FileZilla v3.67 @ win10 / ubuntu. The mode "implicit FTP" does not work with any network (so I guess, it's not supported by the FTP server), but "explicit FTP" also doesn't work. Plain FTP (without encryption) and SFTP (SSH) works fine.

FileZilla has two "explicit FTP" modes:
"Use explicit FTP over TLS if available"
and
"Require explicit FTP over TLS".

Using these modes, I get the following error messages,

with "Use explicit FTP over TLS if available":

Status: Resolving address of DOMAIN.TLD
Status: Connecting to XXX.XXX.XXX.XXX:21...
Status: Connection established, waiting for welcome message...
Status: Insecure server, it does not support FTP over TLS.
[.. continues with plain FTP ..]

with "Require explicit FTP over TLS":

Status: Resolving address of DOMAIN.TLD
Status: Connecting to XXX.XXX.XXX.XXX:21...
Status: Connection established, waiting for welcome message...
Response: 220-FTP server ready.
Response: 220 This is a private system - No anonymous login
Command: AUTH TLS
Response: 504 Command not implemented for that parameter
Command: AUTH SSL
Response: 504 Command not implemented for that parameter
Error: Critical error: Could not connect to server

And as expected, because probably not supported by the FTP server, I get this

with "Require implicit FTP over TLS":

Status: Resolving address of DOMAIN.TLD
Status: Connecting to XXX.XXX.XXX.XXX:990...
Status: Connection attempt failed with "ETIMEDOUT - Connection attempt timed out".
Error: Could not connect to server

[david64]

@patins01 . This link explains Passive and Active mode transfers. Select Passive mode.

If you are unsure of the Passive mode settings, attach a screenshot of them.

https://wiki.filezilla-project.org/Network_Configuration

[patins01]

i tried both, active and passive mode, it doesnt work  the TLS capabilities of my Sagemcom modem seems to be restricted or misconfigured by default. do you have any other ideas what it could be?

[david64]

@patins01 . I think Active will fail because it requires the file server to make an inbound connection to the client, and there has been no outbound connection on the tcp port number.

Passive should work because the client only makes outbound connections to the file server. What was the error message in this case?

[patins01]

the Transfer Mode is "Passive (recommended)" by default in FileZilla so I got the error messages with passive mode.

[david64]

@patins01 . Some Filezilla forums are saying that FTPS doesn't work with CG-NAT.

https://forum.filezilla-project.org/viewtopic.php?t=49565

https://forum.filezilla-project.org/viewtopic.php?t=56719

https://forum.filezilla-project.org/viewtopic.php?t=33886