Hi @TheLumberjack,
Yes the FTP server does send a Passive IP to connect to (which is always wrong given how the Ziti tunnel works... I've tried putting an IP as an intercept and configur ProFTPD to send that IP and it does not seem to work correctly, either). But the good news is Filezilla is smart enough to attempt the data connection to the actual server IP rather than what it "reports" its IP to be, so we can ignore that for now. The control connection appears fine, this is specifically with the data connection.
I captured packets on my windows machine on the ziti tunnel and saw the connection error/RST ACK as per attached screenshot, and I noticed the ziti log aligns with the exact time of the FTPS reset - it appears it may be OpenZiti that is disconnecting if I read these logs right:
[2025-04-11T20:10:18.282Z] ERROR tunnel-sdk:tunnel_tcp.c:190 on_tcp_client_err() client=tcp:100.64.0.1:26186 err=-14, terminating connection
[2025-04-11T20:10:22.663Z] ERROR tunnel-sdk:tunnel_tcp.c:190 on_tcp_client_err() client=tcp:100.64.0.1:26190 err=-14, terminating connection
A rundown on the packet capture from Gemini AI:
- Packet 148 (Client -> Server): TCP
[SYN] - Client initiates connection to port 12001.
- Packet 151 (Server -> Client): TCP
[SYN, ACK] - Server acknowledges and sends its SYN.
- Packet 152 (Client -> Server): TCP
[ACK] - Client acknowledges. The TCP connection on port 12001 is successfully established. This confirms Ziti is correctly forwarding this passive port and ProFTPD (or the tunneler) initially accepted the connection. It rules out the idea that specific passive ports are simply blocked or not configured in Ziti.
- Packet 153 (Client -> Server): TLSv1.2
Client Hello - The client starts the TLS handshake over the new data connection.
- Packet 154 (Server -> Client): TCP
[ACK] - The server acknowledges receiving the Client Hello packet.
- Packet 155 (Server -> Client): TCP
[RST, ACK] - This is the failure point. Immediately after acknowledging the Client Hello, the server side (100.64.0.15) sends a TCP Reset (RST) packet, abruptly killing the data connection.
I haven't captured from the server side yet, but now I'm suspecting it's the ziti tunnel going down/resetting. This does not seem to be a passive ip/port issue so much as the connection for data DOES happen, it's just immediately interrupted.
I tried to find relating Ziti Router logs as well... there are some errors reported here, but I'm not sure what they mean:
Apr 11 20:10:14 HOME2ZITI ziti[39384]: {"file":"github.com/openziti/ziti/router/xgress_edge/accept.go:159","func":"github.com/openziti/ziti/router/xgress_edge.debugPeekHandler.Tx","level":"info","msg":"sending dial: seq: 902 , connId: 256, newConnId: 0, circuitId: 9PpZNxlGaB","time":"2025-04-11T20:10:14.925Z"}
Apr 11 20:10:14 HOME2ZITI ziti[39384]: {"file":"github.com/openziti/ziti/router/xgress_edge/accept.go:147","func":"github.com/openziti/ziti/router/xgress_edge.debugPeekHandler.Rx","level":"info","msg":"received dial result: seq: 903 , replyTo: 902, connId: 256, newConnId: 439, success: true, msg: ","time":"2025-04-11T20:10:14.967Z"}
Apr 11 20:10:15 HOME2ZITI ziti[39384]: {"file":"github.com/openziti/ziti/router/xgress_edge/accept.go:159","func":"github.com/openziti/ziti/router/xgress_edge.debugPeekHandler.Tx","level":"info","msg":"sending dial: seq: 919 , connId: 327, newConnId: 0, circuitId: ct6WN4kdP","time":"2025-04-11T20:10:15.880Z"}
Apr 11 20:10:15 HOME2ZITI ziti[39384]: {"file":"github.com/openziti/ziti/router/xgress_edge/accept.go:147","func":"github.com/openziti/ziti/router/xgress_edge.debugPeekHandler.Rx","level":"info","msg":"received dial result: seq: 919 , replyTo: 919, connId: 327, newConnId: 440, success: true, msg: ","time":"2025-04-11T20:10:15.928Z"}
Apr 11 20:10:16 HOME2ZITI ziti[39384]: {"_context":"{c/ct6WN4kdP|@/ZXlr}\u003cInitiator\u003e","file":"github.com/openziti/ziti/router/xgress/xgress.go:571","func":"github.com/openziti/ziti/router/xgress.(*Xgress).flushSendThenClose.func1","level":"info","msg":"sending end of circuit payload","time":"2025-04-11T20:10:16.139Z"}
Apr 11 20:10:18 HOME2ZITI ziti[39384]: {"file":"github.com/openziti/ziti/router/xgress_edge/accept.go:159","func":"github.com/openziti/ziti/router/xgress_edge.debugPeekHandler.Tx","level":"info","msg":"sending dial: seq: 928 , connId: 327, newConnId: 0, circuitId: lsGZExlda","time":"2025-04-11T20:10:18.641Z"}
Apr 11 20:10:18 HOME2ZITI ziti[39384]: {"_context":"{c/9PpZNxlGaB|@/jvLp}\u003cInitiator\u003e","file":"github.com/openziti/ziti/router/xgress/xgress.go:571","func":"github.com/openziti/ziti/router/xgress.(*Xgress).flushSendThenClose.func1","level":"info","msg":"sending end of circuit payload","time":"2025-04-11T20:10:18.642Z"}
Apr 11 20:10:18 HOME2ZITI ziti[39384]: {"file":"github.com/openziti/ziti/router/xgress_edge/accept.go:147","func":"github.com/openziti/ziti/router/xgress_edge.debugPeekHandler.Rx","level":"info","msg":"received dial result: seq: 929 , replyTo: 928, connId: 327, newConnId: 441, success: true, msg: ","time":"2025-04-11T20:10:18.763Z"}
Apr 11 20:10:22 HOME2ZITI ziti[39384]: {"file":"github.com/openziti/ziti/router/xgress_edge/accept.go:159","func":"github.com/openziti/ziti/router/xgress_edge.debugPeekHandler.Tx","level":"info","msg":"sending dial: seq: 948 , connId: 256, newConnId: 0, circuitId: zw.WExldP","time":"2025-04-11T20:10:22.830Z"}
Apr 11 20:10:22 HOME2ZITI ziti[39384]: {"file":"github.com/openziti/ziti/router/xgress_edge/accept.go:147","func":"github.com/openziti/ziti/router/xgress_edge.debugPeekHandler.Rx","level":"info","msg":"received dial result: seq: 947 , replyTo: 948, connId: 256, newConnId: 442, success: true, msg: ","time":"2025-04-11T20:10:22.878Z"}
Apr 11 20:10:23 HOME2ZITI ziti[39384]: {"_context":"{c/zw.WExldP|@/6KDd}\u003cInitiator\u003e","file":"github.com/openziti/ziti/router/xgress/xgress.go:571","func":"github.com/openziti/ziti/router/xgress.(*Xgress).flushSendThenClose.func1","level":"info","msg":"sending end of circuit payload","time":"2025-04-11T20:10:23.023Z"}
Apr 11 20:10:42 HOME2ZITI ziti[39384]: {"file":"github.com/openziti/ziti/router/xgress_edge/accept.go:159","func":"github.com/openziti/ziti/router/xgress_edge.debugPeekHandler.Tx","level":"info","msg":"sending dial: seq: 954 , connId: 256, newConnId: 0, circuitId: xGPRNxkdP","time":"2025-04-11T20:10:42.837Z"}
Apr 11 20:10:43 HOME2ZITI ziti[39384]: {"file":"github.com/openziti/ziti/router/xgress_edge/accept.go:147","func":"github.com/openziti/ziti/router/xgress_edge.debugPeekHandler.Rx","level":"info","msg":"received dial result: seq: 950 , replyTo: 954, connId: 256, newConnId: 443, success: true, msg: ","time":"2025-04-11T20:10:43.134Z"}
Apr 11 20:10:44 HOME2ZITI ziti[39384]: {"file":"github.com/openziti/ziti/router/xgress_edge/accept.go:159","func":"github.com/openziti/ziti/router/xgress_edge.debugPeekHandler.Tx","level":"info","msg":"sending dial: seq: 971 , connId: 266, newConnId: 0, circuitId: v-ORN4kda","time":"2025-04-11T20:10:44.010Z"}
Apr 11 20:10:44 HOME2ZITI ziti[39384]: {"file":"github.com/openziti/ziti/router/xgress_edge/accept.go:147","func":"github.com/openziti/ziti/router/xgress_edge.debugPeekHandler.Rx","level":"info","msg":"received dial result: seq: 966 , replyTo: 971, connId: 266, newConnId: 444, success: true, msg: ","time":"2025-04-11T20:10:44.056Z"}
Apr 11 20:10:44 HOME2ZITI ziti[39384]: {"_context":"{c/v-ORN4kda|@/bmeO}\u003cInitiator\u003e","file":"github.com/openziti/ziti/router/xgress/xgress.go:571","func":"github.com/openziti/ziti/router/xgress.(*Xgress).flushSendThenClose.func1","level":"info","msg":"sending end of circuit payload","time":"2025-04-11T20:10:44.362Z"}
Apr 11 20:10:44 HOME2ZITI ziti[39384]: {"_context":"{c/v-ORN4kda|@/zvxL}\u003cTerminator\u003e","file":"github.com/openziti/ziti/router/xgress/xgress.go:571","func":"github.com/openziti/ziti/router/xgress.(*Xgress).flushSendThenClose.func1","level":"info","msg":"sending end of circuit payload","time":"2025-04-11T20:10:44.363Z"}
Apr 11 20:10:44 HOME2ZITI ziti[39384]: {"_context":"{c/v-ORN4kda|@/zvxL}\u003cTerminator\u003e","circuitId":"v-ORN4kda","error":"cannot forward payload, no destination for circuit=v-ORN4kda src=zvxL dst=bmeO","file":"github.com/openziti/ziti/router/handler_xgress/receive.go:41","func":"github.com/openziti/ziti/router/handler_xgress.(*receiveHandler).HandleXgressReceive","level":"error","msg":"unable to forward payload","origin":1,"seq":5,"time":"2025-04-11T20:10:44.363Z"}
Apr 11 20:10:48 HOME2ZITI ziti[39384]: {"circuitCount":1,"ctrlId":"ctrl.ziti.domain.net","file":"github.com/openziti/ziti/router/forwarder/faulter.go:107","func":"github.com/openziti/ziti/router/forwarder.(*Faulter).run","level":"warning","msg":"reported forwarding faults","time":"2025-04-11T20:10:48.636Z"}
Edit: I should clarify this error does not happen every-time... it's seemingly random but happens often enough it's interupting the workflow.
