Passive FTP Problem in NAT.

Passive FTP Problem in NAT.

[Svavar Örn Eysteinsson]

Hi.

Could someone help me or give me advice regarding NAT on a FTP server located
in my DMZ.

This is my setup :

My Firewall(Linux 2.4.22-1) :
|
- eth0 = Public Interface (x.x.x.66 / 26 )
|
- eth1 = DMZ Interface (172.16.100.254 / 24 )
|
- eth2 = My Internal Network ( 192.168.1.1 / 24 )


I have a FTP server located on my DMZ Network. The server is listening
on a "non-standard" ftp port. It listens on port : 2121.

To generate my firewall config I use FwBuilder. I've tried many configurations
but, I never get the data port to open( e.g. to list a directory)

In my configuration I've allowed, and NAT'ed the following services
to my FTP server located on the DMZ  :

FTP 		= 	TCP Destination Port : Start : 2121 - End : 2121
FTP_DATA	=	TCP Source Port : Start : 20 - End : 20
			        Destination : Start : 1024 - End : 65535

I can connect, but cannot list the directories.

p.s. I'm running Proftpd on my FTP server. I have also tried to configure
the "PassivePorts= 60000 65534" to configure a group of the passive ports.
But it's the same issue with the directory listening.

Any help would be much appreciated.


Best regards to all, 

Svavar O
Reykjavik - Iceland

Passive FTP Problem in NAT.

[svavar]

[-- Attachment #1: Type: text/plain, Size: 1217 bytes --]

Hi.

Could someone help me or give me advice regarding NAT on a FTP server located in my DMZ.

This is my setup :

My Firewall(Linux 2.4.22-1) :
|
- eth0 = Public Interface (x.x.x.66 / 26 )
|
- eth1 = DMZ Interface (172.16.100.254 / 24 )
|
- eth2 = My Internal Network ( 192.168.1.1 / 24 )


I have a FTP server located on my DMZ Network. The server is listening on a “non-standard” ftp port. It listens on port : 2121.

To generate my firewall config I use FwBuilder. I’ve tried many configurations but, I never get the data port to open( e.g. to list a directory)

In my configuration I’ve allowed, and NAT’ed the following services to my FTP server located on the DMZ  :

FTP 		= 	TCP Destination Port : Start : 2121 – End : 2121
FTP_DATA	=	TCP Source Port : Start : 20 – End : 20
			        Destination : Start : 1024 – End : 65535

I can connect, but cannot list the directories.

p.s. I’m running Proftpd on my FTP server. I have also tried to configure the “PassivePorts= 60000 65534” to configure a group of the passive ports.
But it’s the same issue with the directory listening.

Any help would be much appreciated.


Best regards to all, 

Svavar O
Reykjavik - Iceland

Re: Passive FTP Problem in NAT.

[Aleksandar Milivojevic]

svavar@atom01.is wrote:
> I have a FTP server located on my DMZ Network. The server is listening on a “non-standard” ftp port. It listens on port : 2121.
> 
> To generate my firewall config I use FwBuilder. I’ve tried many configurations but, I never get the data port to open( e.g. to list a directory)
> 
> In my configuration I’ve allowed, and NAT’ed the following services to my FTP server located on the DMZ  :
> 
> FTP 		= 	TCP Destination Port : Start : 2121 – End : 2121
> FTP_DATA	=	TCP Source Port : Start : 20 – End : 20
> 			        Destination : Start : 1024 – End : 65535
> 
> I can connect, but cannot list the directories.
> 
> p.s. I’m running Proftpd on my FTP server. I have also tried to configure the “PassivePorts= 60000 65534” to configure a group of the passive ports.
> But it’s the same issue with the directory listening.

Without having a look into your actual rules (or relevant part of it), 
it is hard to tell what is wrong.  Neiter me (nor most people here) 
can't guess what would be the rules generated by FwBuilder.  Give us 
actual rules, somebody might spot what is wrong, and than you can try to 
get FwBuiler to generate correct rules.

My guesses would be that you either:

a) did not load ip_nat_ftp module (it doesn't get loaded automatically)

b) failed to specify that your FTP server is on non-default port (from 
documentation --m helper --helper ftp-2121, but I haven't tested if this 
will suffice, maybe you also need to pass port number to module directly).

c) first packet of data connection is going to be in RELATED state (not 
NEW), if you have ip_nat_ftp loaded (which in turn loads ip_conntrack_ftp).

d) most important of all: passive FTP data transfers do not use port 20. 
  Both ports (source and destination) should be 1024+.  This is because 
connection is from client to server.  Port 20 is used by active FTP data 
transfers (and connection is from server to client).

-- 
Aleksandar Milivojevic <amilivojevic@pbl.ca>    Pollard Banknote Limited
Systems Administrator                           1499 Buffalo Place
Tel: (204) 474-2323 ext 276                     Winnipeg, MB  R3T 1L7

Re: Passive FTP Problem in NAT.

[Jason Opperisano]

On Wed, 2004-09-15 at 11:13, svavar@atom01.is wrote:
> Hi.
> 
> Could someone help me or give me advice regarding NAT on a FTP server located in my DMZ.
> 
> This is my setup :
> 
> My Firewall(Linux 2.4.22-1) :
> |
> - eth0 = Public Interface (x.x.x.66 / 26 )
> |
> - eth1 = DMZ Interface (172.16.100.254 / 24 )
> |
> - eth2 = My Internal Network ( 192.168.1.1 / 24 )
> 
> 
> I have a FTP server located on my DMZ Network. The server is listening on a non-standard ftp port. It listens on port : 2121.

bingo.  the standard modprobe commands won't work in your situation. 
try:

        modprobe ip_conntrack_ftp ports=21,2121
        modprobe ip_nat_ftp ports=21,2121

to force the helper to watch your specific port.

-j

-- 
Jason Opperisano <opie@817west.com>

Re: Passive FTP Problem in NAT.

[Arthur Meyer]

Is the nat-ftp-helper module loades?

insmod ip_nat_ftp

Arthur Meyer

On Wednesday 15 September 2004 16:51, Svavar Örn Eysteinsson wrote:
> Hi.
>
> Could someone help me or give me advice regarding NAT on a FTP server
> located in my DMZ.
>
> This is my setup :
>
> My Firewall(Linux 2.4.22-1) :
>
> - eth0 = Public Interface (x.x.x.66 / 26 )
>
> - eth1 = DMZ Interface (172.16.100.254 / 24 )
>
> - eth2 = My Internal Network ( 192.168.1.1 / 24 )
>
>
> I have a FTP server located on my DMZ Network. The server is listening
> on a "non-standard" ftp port. It listens on port : 2121.
>
> To generate my firewall config I use FwBuilder. I've tried many
> configurations but, I never get the data port to open( e.g. to list a
> directory)
>
> In my configuration I've allowed, and NAT'ed the following services
> to my FTP server located on the DMZ  :
>
> FTP 		= 	TCP Destination Port : Start : 2121 - End : 2121
> FTP_DATA	=	TCP Source Port : Start : 20 - End : 20
> 			        Destination : Start : 1024 - End : 65535
>
> I can connect, but cannot list the directories.
>
> p.s. I'm running Proftpd on my FTP server. I have also tried to configure
> the "PassivePorts= 60000 65534" to configure a group of the passive ports.
> But it's the same issue with the directory listening.
>
> Any help would be much appreciated.
>
>
> Best regards to all,
>
> Svavar O
> Reykjavik - Iceland

-- 

This email was created using 100% recycled electrons.