I have been at this a few times and have become completely stuck in configuring this. Currently, I have this set up for an FTP server:Local PC (My MAC) -> AWS EC2 (HaProxy) -> FTP ServerHere's a few things I have done so far:Confirmed Ports 20/21 are open in Security GroupsConfigured in SGs that TCP ports are opened (for passive ports).Confirmed via netstat that the appropriate ports are opened ( as a sanity check, I got HaProxy to bind to 0-65535 TCP ports (same for SGs).Ran TCPDump while trying to connect to the FTP server via the proxyHere is a copy of my haproxy.cfglisten FTP :21, :10000-10250        mode tcp        log 127.0.0.1 local0 debug info warning error        bind *:21        bind *:20        server foo xx.xx.xx.xx:21 check port 21When I run tcpdump, I get:10:54:11.695983 IP 10.33.x.x.56374 > ec2-54-234-x-x.compute-1.amazonaws.com.ftp: Flags [P.], seq 45:51, ack 684, win 16384, options [nop,nop,TS val 652929632 ecr 148377527], length 6: FTP: EPSV10:54:11.726462 IP ec2-54-234-x-x.compute-1.amazonaws.com.ftp > 10.33.x.x.56374: Flags [P.], seq 684:726, ack 51, win 227, options [nop,nop,TS val 148377680 ecr 652929632], length 42: FTP: 229 Extended Passive mode OK (|||12612|)10:54:11.726513 IP 10.33.x.x.56374 > ec2-54-234-x-x.compute-1.amazonaws.com.ftp: Flags [.], ack 726, win 16378, options [nop,nop,TS val 652929662 ecr 148377680], length 010:55:27.134823 IP 10.33.x.x.56374 > ec2-54-234-x-x.compute-1.amazonaws.com.ftp: Flags [P.], seq 51:80, ack 726, win 16384, options [nop,nop,TS val 653004663 ecr 148377680], length 29: FTP: EPRT |1|10.33.x.x|56397|10:55:27.165241 IP ec2-54-234-x-x.compute-1.amazonaws.com.ftp > 10.33.x.x.56374: Flags [P.], seq 726:798, ack 80, win 227, options [nop,nop,TS val 148396540 ecr 653004663], length 72: FTP: 500 I won't open a connection to 50.232.x.x (only to 54.234.x.x)10:55:27.165287 IP 10.33.x.x.56374 > ec2-54-234-x-x.compute-1.amazonaws.com.ftp: Flags [.], ack 798, win 16375, options [nop,nop,TS val 653004693 ecr 148396540], length 010:55:27.165377 IP 10.33.x.x.56374 > ec2-54-234-x-x.compute-1.amazonaws.com.ftp: Flags [P.], seq 80:106, ack 798, win 16384, options [nop,nop,TS val 653004693 ecr 148396540], length 26: FTP: PORT 10,33,x,x,220,7710:55:27.194982 IP ec2-54-234-x-x.compute-1.amazonaws.com.ftp > 10.33.x.x.56374: Flags [P.], seq 798:870, ack 106, win 227, options [nop,nop,TS val 148396547 ecr 653004693], length 72: FTP: 500 I won't open a connection to 50.232.x.x (only to 54.234.x.x)10:55:27.195025 IP 10.33.x.x.56374 > ec2-54-234-x-x.compute-1.amazonaws.com.ftp: Flags [.], ack 870, win 16375, options [nop,nop,TS val 653004722 ecr 148396547], length 010:55:27.195304 IP 10.33.x.x.56374 > ec2-54-234-x-x.compute-1.amazonaws.com.ftp: Flags [P.], seq 106:112, ack 870, win 16384, options [nop,nop,TS val 653004722 ecr 148396547], length 6: FTP: LIST10:55:27.224432 IP ec2-54-234-x-x.compute-1.amazonaws.com.ftp > 10.33.x.x.56374: Flags [P.], seq 870:894, ack 112, win 227, options [nop,nop,TS val 148396555 ecr 653004722], length 24: FTP: 425 No data connection10:55:27.224464 IP 10.33.x.x.56374 > ec2-54-234-x-x.compute-1.amazonaws.com.ftp: Flags [.], ack 894, win 16381, options [nop,nop,TS val 653004751 ecr 148396555], length 0I configured logging on HaProxy and currently have this (not sure if this is helpful):Jun 12 14:49:25 localhost haproxy[18805]: 50.232.x.x:14857 [12/Jun/2017:14:48:24.811] FTP FTP/media 1/14/60772 792 -- 0/0/0/0/0 0/0Jun 12 14:49:25 localhost haproxy[18805]: 50.232.x.x:14857 [12/Jun/2017:14:48:24.811] FTP FTP/media 1/14/60772 792 -- 0/0/0/0/0 0/0Jun 12 14:51:48 localhost haproxy[18805]: 50.232.x.x:56254 [12/Jun/2017:14:49:41.820] FTP FTP/media 1/13/127012 960 -- 0/0/0/0/0 0/0Jun 12 14:51:48 localhost haproxy[18805]: 50.232.x.x:56254 [12/Jun/2017:14:49:41.820] FTP FTP/media 1/13/127012 960 -- 0/0/0/0/0 0/0Jun 12 14:52:02 localhost haproxy[18805]: 50.232.x.x:56342 [12/Jun/2017:14:51:54.618] FTP FTP/media 1/14/7670 401 -- 1/1/1/1/0 0/0Jun 12 14:52:02 localhost haproxy[18805]: 50.232.x.x:56342 [12/Jun/2017:14:51:54.618] FTP FTP/media 1/14/7670 401 -- 1/1/1/1/0 0/0Jun 12 14:53:36 localhost haproxy[18805]: 50.232.x.x:56345 [12/Jun/2017:14:51:59.386] FTP FTP/media 1/19/97481 1032 -- 0/0/0/0/0 0/0Jun 12 14:53:36 localhost haproxy[18805]: 50.232.x.x:56345 [12/Jun/2017:14:51:59.386] FTP FTP/media 1/19/97481 1032 -- 0/0/0/0/0 0/0Jun 12 14:53:59 localhost haproxy[18805]: 50.232.x.x:56373 [12/Jun/2017:14:53:37.880] FTP FTP/media 1/14/21641 333 -- 0/0/0/0/0 0/0Jun 12 14:53:59 localhost haproxy[18805]: 50.232.x.x:56373 [12/Jun/2017:14:53:37.880] FTP FTP/media 1/14/21641 333 -- 0/0/0/0/0 0/0I can connect to the FTP Server and cd to directories. I cannot run an ls/put/get on there though. When I try on passive mode, I get: ftp> ls229 Extended Passive mode OK (|||12612|)ftp: Can't connect to `54.234.x.x': Operation timed out500 I won't open a connection to 50.232.x.x (only to 54.234.x.x)425 No data connectionRunning on Active mode:Passive mode: off; fallback to active mode: off.ftp> ls500 I won't open a connection to 50.232.x.x (only to 54.234.x.x)425 No data connectionI don't believe this to be an issue particularly with the FTP servers only because I can connect to it via the proxy. Even when I connect to the FTP servers directly, I can run commands on active and passive mode. My questions are:What else can I look into that can further troubleshoot this?Is there any further logging configurations I can do that would enhance logging for any kind of TCP requests other than what I currently have?Is there something configuration wise I am missing in HaProxy (I know that natively HaProxy is an HTTP load balancer but I looked up enough examples where I can configure it to be used as a proxy for FTP servers and I cannot reconfigure the FTP servers to be ran as SFTP)?
HaProxy 1.5.8 to FTP server
ftp;haproxy
After much research and some investigation with my colleague on this, this is what was happening:HaProxy could have been a viable solution. But, the FTP server is configured to force passive mode. HaProxy can be used to proxy FTP connections but there is no real way to configure it to react accordingly to Passive connections. As a result, I was unable to run the ls/get/put (and probably even more) commands! My Solution was to go to ftp-proxy and configure it. Once I configured ftp-proxy to route traffic to the FTP server (while configuring it to listen to passive connnections), VIOLA! It worked!!