Warning: Declaration of action_plugin_indexmenu::register(&$controller) should be compatible with DokuWiki_Action_Plugin::register(Doku_Event_Handler $controller) in /home/httpd/vhosts/scratchbook.ch/wiki.scratchbook.ch/lib/plugins/indexmenu/action.php on line 18

Warning: Cannot modify header information - headers already sent by (output started at /home/httpd/vhosts/scratchbook.ch/wiki.scratchbook.ch/lib/plugins/indexmenu/action.php:0) in /home/httpd/vhosts/scratchbook.ch/wiki.scratchbook.ch/inc/auth.php on line 495

Warning: Cannot modify header information - headers already sent by (output started at /home/httpd/vhosts/scratchbook.ch/wiki.scratchbook.ch/lib/plugins/indexmenu/action.php:0) in /home/httpd/vhosts/scratchbook.ch/wiki.scratchbook.ch/inc/actions.php on line 687

Warning: Cannot modify header information - headers already sent by (output started at /home/httpd/vhosts/scratchbook.ch/wiki.scratchbook.ch/lib/plugins/indexmenu/action.php:0) in /home/httpd/vhosts/scratchbook.ch/wiki.scratchbook.ch/inc/actions.php on line 687

Warning: Cannot modify header information - headers already sent by (output started at /home/httpd/vhosts/scratchbook.ch/wiki.scratchbook.ch/lib/plugins/indexmenu/action.php:0) in /home/httpd/vhosts/scratchbook.ch/wiki.scratchbook.ch/inc/actions.php on line 687
https://community.ubnt.com/t5/EdgeMAX/FTP-server-with-dynamic-IP-and-behind-NAT-with-EdgeRouter-Lite/td-p/1279205

This is a working configuration to set up an FTP server even if you have no static public IPv4 and your FTP server is in the NATed LAN. I'm using pure-ftpd with linux for some server-side settings; Router is
EdgeRouter Lite v1.6.0. This config only allows passive FTP, not active (PORT).
 
**DynDNS**

I'm using afraid FreeDNS because it's free and in the supported DynDNS lists on the EdgeOS.
 
Configuration in EdgeOS webgui:

  *     Services -> DNS -> Dynamic DNS
  *     set interface to your WAN interface
  *     Service is afraid
  *     hostname: the subdomain you set up with afraid
  *     Login and Password are your afraid login credentials
  *     click apply then force update

 
**pure-ftpd**

Assuming you have already set up ftp system user/group, login users with data directory and tls certificate stuff.
The ftp server is somewhere in your LAN, I'm using 192.168.1.0/24 addresses in the example.
 
Note that this is a working but not full command, you most likely have to set some additional parameters for security and over-load prevention
 
Now you have to start pure-ftpd with the following settings in mind (important for this specific setup in bold):

  *     IPv4 only (-4)
  *     Chroot users (-A) and disable anonymous login (-E)
  *     run as daemon (-B)
  *     set authentication (-l)
  *     Port range to use for passive ftp (-p) -- use this to set a range of eg. 200 ports for data connections, I'm using 21000 to 21200 in the example
  *     public IP to use for announced passive connections (-P) -- use your dyndns hostname that resolves to your current public IP
  *     IP address and port of the interface to bind to (-s), example using 192.168.1.5, the comma in the example is no mistake, the port comes afterwards but if omitted it defaults to 21
  *     Use TLS encryption for control and data channels (--tls) and only HIGH ciphers (--tlsciphersuite), omit both if you don't want encryption

So we have the following command now:
 
<code>/usr/sbin/pure-ftpd -4 -A -E -l <dbtype>:<full db path> -p 21000:21200 -P blub.ignorelist.com -s 192.168.1.5, --tls=3 --tlsciphersuite HIGH</code>
 
**Firewall configuration**

You need to

  *     Allow connections to external port 21 and the data portrange from above
  *     DNAT those ports to forward them to your server's LAN IP

 
Configuration in EdgeOS webgui:
 
Go to Firewall/NAT -> Firewall Policies
Open ruleset WAN_IN (WAN to internal), add two new Rules:

  *     enable, Action accept, Protocol TCP, Destination -> Port 21
  *     enable, Action accept, Protocol TCP, Destination -> Port 21 

Go to Firewall/NAT -> NAT
Add two Destination NAT rules:

  *     enable, inbound interface: your WAN interface, Translations: Address 192.168.1.5 (use the correct one that your ftp server has), Port 21, Protocol TCP, Dest: Port 21 
  *     enable, inbound interface: your WAN interface, Translations: Address 192.168.1.5 (use the correct one that your ftp server has) Port (leave empty), Protocol TCP, Dest: Port 21000-21200 

 

 

Drawbacks of this configuration: No PORT (active mode), not using ip_conntrack_ftp or ip_nat_ftp.

But it's at least working for me.