Re: Is ip_conntrack_ftp needed for 1:1 nat?

[Pascal Hambourg <pascal.mail@plouf.fr.eu.org>]

Sietse van Zanen wrote :
> BZZZZZZZZT

Huh ?

> You have just missed the 1.000.000 dollar question. The short answer is indeed: NO.
>  
> When you do pure 1:1 NAT and don't filter any traffic, you do not need
> to track connections, as any packet will just get NATted between the two
> addresses.

Packets will. But addresses in PORT commands or PASV replies won't. So 
when the sender of this information is masqueraded, the other side will 
try (and mostly fail) to connect to the given private address or simply 
refuse to connect because it does not match the apparent address 
(protection against abuse).

Possible workaround in passive mode : use the command EPSV instead of 
PASV, because unlike the PASV reply, the EPSV reply does not contain the 
(useless because already known) server address.
Limit : it works only for a masqueraded server, but the use of EPSV is 
up to the client, and not all FTP clients support it.

I repeat, FTP will work without tracking control connections nor special 
setup on the NATed host only in the following conditions :

- active mode with a non NATed client, so PORT commands contain the 
expected address (the server may be NATed) ;
- passive mode with a non NATed server, so PASV replies contain the 
expected address (the client may be NATed) ;
- passive mode with a NATed server when the client uses EPSV (client may 
also be NATed) ;