All of lore.kernel.org
 help / color / mirror / Atom feed
* [LARTC] DNAT rule for vsftp (PASSIVE FTP)
@ 2007-10-05  5:52 Indunil Jayasooriya
  2007-10-05  6:55 ` Grant Taylor
                   ` (2 more replies)
  0 siblings, 3 replies; 4+ messages in thread
From: Indunil Jayasooriya @ 2007-10-05  5:52 UTC (permalink / raw)
  To: lartc


[-- Attachment #1.1: Type: text/plain, Size: 1698 bytes --]

Hi all,

I want to run vsftp behind a firewall.(i.e DMZ zone) . It is runnig as
passive ftp.

the theroy behind passive ftp is ,


   - FTP server's port 21 from anywhere (Client initiates connection)
   - FTP server's port 21 to ports > 1024 (Server responds to client's
   control port)
   - FTP server's ports > 1024 from anywhere (Client initiates data
   connection to random port specified by server)
   - FTP server's ports > 1024 to remote ports > 1024 (Server sends ACKs
   (and data) to client's data port)



Then, How can I write DNAT rules.

pls assume 1.2.3.4 is the ip of the internert interface.

#DNAT from Internet to the box running VSFTP @ 192.168.100.3
iptables -t nat -A PREROUTING -p tcp -i eth0 -d 1.2.3.4 --dport 21 -j DNAT
--to-destination 192.168.100.3:21
iptables -t nat -A PREROUTING -p tcp -i eth0 -d 1.2.3.4 --dport 1024: -j
DNAT --to-destination 192.168.100.3

And also
#connect to below ip (actual destination ip) with below ports,due to DNATing

iptables -A FORWARD -p tcp -d 192.168.100.3 --dport 21 -m state --state NEW
-j ACCEPT
iptables -A FORWARD -p tcp -d 192.168.100.3 --dport 1024: -m state --state
NEW -j ACCEPT


R u okay with the above 4 rules ?

If WRONG, pls write down your rules. I am going to put this vsftp server in
to PRODUCTION USE.


Pls also make sure , my firewall has below rules such as DROP,
ESTABLISHED,RELATED.

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT


YOUR comments.


-- 
Thank you
Indunil Jayasooriya

[-- Attachment #1.2: Type: text/html, Size: 2848 bytes --]

[-- Attachment #2: Type: text/plain, Size: 143 bytes --]

_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

^ permalink raw reply	[flat|nested] 4+ messages in thread
end of thread, other threads:[~2007-10-05 14:18 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2007-10-05  5:52 [LARTC] DNAT rule for vsftp (PASSIVE FTP) Indunil Jayasooriya
2007-10-05  6:55 ` Grant Taylor
2007-10-05  7:28 ` Indunil Jayasooriya
2007-10-05 14:18 ` Grant Taylor

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.