Passive FTP

In passive mode File Transfer Protocol (FTP), the client initiates all connections to the server, making it compatible with intermediary proxies and firewalls. In contrast, active mode FTP has the server initiate connections to the client, and this is often blocked. For this reason, passive FTP is recommended over active FTP.

The passive configuration documented on this page supports not only FTP but also FTPS. It does not support SFTP.

Configure FTP servers Jump to heading #

Perform these steps on the FTP servers. Consult the documentation for your FTP server.

1. Configure your FTP server to use passive mode. It should return the IP address of the load balancer as the advertised address of the FTP service. Later, we will configure the load balancer to listen at this address.

   For example, on a vsftpd FTP server, set the pasv_address variable to the IP address of the FTP service configured on the load balancer:

   pasv_address=192.168.0.100  # IP of ftp.example.com

   pasv_address=192.168.0.100  # IP of ftp.example.com

2. Configure the passive FTP port range on the FTP server. For example, you might use the port range 50000-50010, or you can use a larger range. Be careful to limit the port range to prevent file descriptor exhaustion.

Configure the load balancer Jump to heading #

1. Update your frontend section in the following ways:

   • In the bind directives, set the IP addresses to match the advertised FTP site IP (the pasv_address on the FTP server).
   • In the second bind directive, enter the port range your FTP servers use for data connections (for example, 50000-50010).

   haproxy
   frontend ftp_fe
     mode tcp
     option tcplog
     log global
     bind 192.168.0.100:21          name ftp-control
     bind 192.168.0.100:50000-50010 name ftp-data
     
     default_backend ftp_servers

   haproxy
   frontend ftp_fe
     mode tcp
     option tcplog
     log global
     bind 192.168.0.100:21          name ftp-control
     bind 192.168.0.100:50000-50010 name ftp-data
     
     default_backend ftp_servers

2. Update your backend section in the following ways:

   • Configure the server directives to use the FTP servers’ IP addresses. Below, we use the FTP servers at 192.168.1.10 and 192.168.1.11.
   • Add stick-table and stick on directives to enable session persistence. This will route a client to the same server for both control and data. It also provides support for FTPS. See Session persistence.

   haproxy
   backend ftp_servers
     mode tcp
     balance leastconn
                          
     stick-table type ip size 100k expire 1h
     stick on src   
     server ftp-server1 192.168.1.10 check port 21
     server ftp-server2 192.168.1.11 check port 21

   haproxy
   backend ftp_servers
     mode tcp
     balance leastconn
                          
     stick-table type ip size 100k expire 1h
     stick on src   
     server ftp-server1 192.168.1.10 check port 21
     server ftp-server2 192.168.1.11 check port 21

See also Jump to heading #

• mode
• Session persistence
• Stick tables