Accessing my NAS server using FTP

Unencrypted FTP usually needs 2 ports to be forwarded. Port 1 for data and Port 2 for control.

In default this is usually port 20 and 21. So you maybe missed to forward port 20.

If you have changed the control port to something else, you will need to change accordingly. The data port is usually 1 port lower than control.

I would avoid using FTP, especially if you (and/or the other end) are behind a NAT router. SFTP is more secure and doesn't have the potential firewall problems that FTP has.

I agree.

Here is what i did, to secure this up:

1. change standard port to a high port

2. Use encryption on data and com channel (i dont use SFTP but FTP over TLS. SFTP should be easier to setup) . Authentication using certificate

3. Use fail2ban to ban login after 3 unsuccseful login attempts

4. Configure your FTP server to not spit out too much info for login attempts. e.g. if someone tries to use a username that is unknown to my server, it will not reply at all. leaving the client in the dark

5. If you can, limit logins to a specific IP or IP range

I use GLFTPD in docker. This is great but for your purpose probably overkill and also pretty hard to configure in the beginning. So you better stick with the default SFTP of OMV.

Alternatively you can set up a VPN access and only allow FTP/SFTP on local network, tunelling through the VPN. That is probably the most secure you can do.

1. Verify your FTP is accesible from LAN

2. If you use FTP/FTPS/FTPES, deal with the PASV response from the server

3. adjust PASV range data ports and control port to your router's NAT

4. increase the debug level on the server and client side.

As gderf says sftp has many advantages

Zitat von roeegg2

Hey,

Sorry for my ignorance, it's my first time ever making a NAS server..

Anyway, I built my own NAS using a raspberry pi 3 I had lying around.
I've succesfully installed OMV on it, and have SMB and FTP running smoothly on LAN.
I want to make it WAN accessible, but I'm really lost...

Please can you explain your goal, perhaps a filebrowser that use https:// and user/password to access your files outside your LAN are better idea.

https://filebrowser.org/installation <- easy to install on a docker and access via Swag ( reverse proxy).

PD : you can also install wetty and gain control over your S.O. but please consider always use a reverse proxy and user/password to acess landing page.