Use FTP through SSH tunnel

Set up a test case to allow FTP through SSH tunnel


First ... disallow any connection other than SSH, we have to be sure that ftp communicates only through tunnel

    root@devuan:~# iptables -A OUTPUT -o eth0 -p tcp --dport 22 -j ACCEPT
    root@devuan:~# iptables -A OUTPUT -o eth0 -j DROP
    root@devuan:~# iptables -A INPUT -i eth0 -p tcp --sport 22 -j ACCEPT
    root@devuan:~# iptables -A INPUT -i eth0 -j DROP


Now set up some parameter on ftp server. We use vsftpd: version 2.3.5

    root@ftpserver_name:~# diff /etc/vsftpd.conf_orig /etc/vsftpd.conf | grep -v '#'
    > pasv_address=127.0.0.1
    > pasv_enable=YES
    > pasv_min_port=2010
    > pasv_max_port=2012


On client side forward these port to your server

    ssh -f root@ftpserver_address -N -L 21:ftpserver_address:21 -L 2010:ftpserver_address:2010 -L 2011:ftpserver_address:2011 -L 2012:ftpserver_address:2012


Then the trick is to make sure that client uses IPv4 only on switch directly to passive mode:

    root@devuan:~# ftp -4 localhost
    Connected to localhost.
    220 This is a private file server.
    Name (localhost:administrator): ftp-user
    331 Please specify the password.
    Password:
    230 Login successful.
    Remote system type is UNIX.
    Using binary mode to transfer files.
    ftp> passive
    Passive mode on.
    ftp> put ftptest.PUT
    local: ftptest.PUT remote: ftptest.PUT
    227 Entering Passive Mode (127,0,0,1,7,219).
    150 Ok to send data.
    226 Transfer complete.
    47 bytes sent in 0.00 secs (445.6159 kB/s)
    ftp> quit
    221 Goodbye.