Re: FTP Forwarding

["Test Mail" <testmail@peterpaul.com.ph>]

Hi!Can i have a follow up question regarding FTP server inside internal LAN
which can be seen in the internet.....
now what if the scenario is i want to restrict a specific Public IP Address
in using my FTP what will be the rules that i should  apply?

I was thinking of setting up a rule that will filter incomming Public IP
Address request for ftp before it forwards it into my internal FTP Server.

Below are the sample entry in my iptables:
iptables -t filter -A INPUT -p tcp -s $PublicIPAdd --dport 20:21 -j ACCEPT
<--- is this correct?
iptables -t filter -A INPUT -j DROP

Below are the previous solution that you gave.

modprobe ip_conntrack_ftp
modprobe ip_nat_ftp

 iptables -t nat -A PREROUTING -i $EXT_IF -p tcp -d 202.147.167.99 \
   --dport 21 -j DNAT --to-destination 192.168.0.5

 iptables -A FORWARD -i $EXT_IF -o $INT_IF -p tcp --syn -d 192.168.0.5 \
   --dport 21 -j ACCEPT

 the above assumes you have a rule in FORWARD that accepts established
 packets, such as:

 iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

 hth...

 -j

Thanks in advance!
Milo

----- Original Message -----
From: "Jason Opperisano" <opie@817west.com>
To: <netfilter@lists.netfilter.org>
Sent: Wednesday, December 29, 2004 01:30 AM
Subject: Re: FTP Forwarding


> On Tue, 2004-12-28 at 12:19, umar draz wrote:
> > Hi Dear Members!
> >
> >   i have linux machine which configured as a router
> >
> >   my linux router has 2 NIC one with Public ip 202.147.167.99 and other
is local ip 192.168.0.1
> >   i have a another linux machine which configured as a FTP server and
that machine ip is 192.168.0.5. Now i want my this ftp server can be access
all world. so what kind of iptables rules will be add on linux router that
if some one want to access ftp 202.147.167.99 its automaticaly forward or
redirect my local machine 192.168.0.5.
> >
> >  Please help me in this regard
> >
> > Thanks
> >
> > Umar
>
> modprobe ip_conntrack_ftp
> modprobe ip_nat_ftp
>
> iptables -t nat -A PREROUTING -i $EXT_IF -p tcp -d 202.147.167.99 \
>   --dport 21 -j DNAT --to-destination 192.168.0.5
>
> iptables -A FORWARD -i $EXT_IF -o $INT_IF -p tcp --syn -d 192.168.0.5 \
>   --dport 21 -j ACCEPT
>
> the above assumes you have a rule in FORWARD that accepts established
> packets, such as:
>
> iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
>
> hth...
>
> -j
>
> --
> "Well, I'm tired of being a wannabe league bowler. I wanna be a
>  league bowler!"
> --The Simpsons
>
>