From mboxrd@z Thu Jan 1 00:00:00 1970 From: Aleksandar Milivojevic Subject: Re: Passive FTP Problem in NAT. Date: Wed, 15 Sep 2004 10:39:31 -0500 Sender: netfilter-bounces@lists.netfilter.org Message-ID: <41486233.8060301@pbl.ca> References: <1095261204.9082@wormhole.atom.is> Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <1095261204.9082@wormhole.atom.is> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="windows-1252"; format="flowed" To: netfilter@lists.netfilter.org svavar@atom01.is wrote: > I have a FTP server located on my DMZ Network. The server is listening = on a =93non-standard=94 ftp port. It listens on port : 2121. >=20 > To generate my firewall config I use FwBuilder. I=92ve tried many confi= gurations but, I never get the data port to open( e.g. to list a director= y) >=20 > In my configuration I=92ve allowed, and NAT=92ed the following services= to my FTP server located on the DMZ : >=20 > FTP =3D TCP Destination Port : Start : 2121 =96 End : 2121 > FTP_DATA =3D TCP Source Port : Start : 20 =96 End : 20 > Destination : Start : 1024 =96 End : 65535 >=20 > I can connect, but cannot list the directories. >=20 > p.s. I=92m running Proftpd on my FTP server. I have also tried to confi= gure the =93PassivePorts=3D 60000 65534=94 to configure a group of the pa= ssive ports. > But it=92s the same issue with the directory listening. Without having a look into your actual rules (or relevant part of it),=20 it is hard to tell what is wrong. Neiter me (nor most people here)=20 can't guess what would be the rules generated by FwBuilder. Give us=20 actual rules, somebody might spot what is wrong, and than you can try to=20 get FwBuiler to generate correct rules. My guesses would be that you either: a) did not load ip_nat_ftp module (it doesn't get loaded automatically) b) failed to specify that your FTP server is on non-default port (from=20 documentation --m helper --helper ftp-2121, but I haven't tested if this=20 will suffice, maybe you also need to pass port number to module directly). c) first packet of data connection is going to be in RELATED state (not=20 NEW), if you have ip_nat_ftp loaded (which in turn loads ip_conntrack_ftp= ). d) most important of all: passive FTP data transfers do not use port 20.=20 Both ports (source and destination) should be 1024+. This is because=20 connection is from client to server. Port 20 is used by active FTP data=20 transfers (and connection is from server to client). --=20 Aleksandar Milivojevic Pollard Banknote Limited Systems Administrator 1499 Buffalo Place Tel: (204) 474-2323 ext 276 Winnipeg, MB R3T 1L7