Re: portfw on iptables 2.4 kernel problem.

[Joel Newkirk <netfilter@newkirk.us>]

On Wednesday 11 December 2002 02:32 am, Reckhard, Tobias wrote: 
{heavily snipped by Joel}

> I expect you're trying to access the FTP server on 10.0.0.11 from the
> Internet by redirecting connections to the firewall's external IP
> address (203.100.100.1) to the FTP server.

> Take care of the FTP control connection:
> 2. Permit INPUT on the outside interface of the firewall to TCP port
> 21 with states NEW and ESTABLISHED
> 3. Permit OUTPUT on the outside interface of the firewall from TCP
> port 21 with state ESTABLISHED
> 4. In the PREROUTING chain use DNAT to redirect packets "-p tcp -d
> 203.100.100.1 --dport 21" (see point 2 above) to the internal server
> at 10.0.0.11.
> 5. Permit FORWARDing of those same packets with states NEW and
> ESTABLISHED. 6. Permit FORWARDing of response packets ("-s 10.0.0.11
> --sport 21") with state ESTABLISHED.

This wouldn't work at all.  INPUT shouldn't enter into it at all, unless 
the DNAT fails, and OUTPUT only if a packet is required to leave the 
firewall machine itself, IE if that is where the connection is attempted 
from or to.  Also, for the FTP conntrack helper to work you HAVE to 
allow state RELATED.  FTP will open a control connection to port 21, 
then a request for data will (in passive) cause the server to attempt to 
open a connection BACK to the client's port 20, IE.  This is RELATED, in 
a nutshell.  The FTP helper is required because the control packets will 
embed IP and port data inside the packet itself, rather than its header, 
and without the helper netfilter will only handle the header.

j