Re: FTP Forwarding

["Deepak Seshadri" <dseshadri@broadbandmaritime.com>]

iptables -t nat -A PREROUTING -i $EXT_IF -p tcp -s $PublicIPAdd -d 
202.147.167.99 \
   --dport 21 -j DNAT --to-destination 192.168.0.5


Deepak Seshadri



----- Original Message ----- 
From: "Test Mail" <testmail@peterpaul.com.ph>
To: "Netfilter Mailing List" <netfilter@lists.netfilter.org>
Sent: Friday, January 14, 2005 3:57 AM
Subject: Re: FTP Forwarding


> Hi!Can i have a follow up question regarding FTP server inside internal 
> LAN
> which can be seen in the internet.....
> now what if the scenario is i want to restrict a specific Public IP 
> Address
> in using my FTP what will be the rules that i should  apply?
>
> I was thinking of setting up a rule that will filter incomming Public IP
> Address request for ftp before it forwards it into my internal FTP Server.
>
> Below are the sample entry in my iptables:
> iptables -t filter -A INPUT -p tcp -s $PublicIPAdd --dport 20:21 -j ACCEPT
> <--- is this correct?
> iptables -t filter -A INPUT -j DROP
>
> Below are the previous solution that you gave.
>
> modprobe ip_conntrack_ftp
> modprobe ip_nat_ftp
>
> iptables -t nat -A PREROUTING -i $EXT_IF -p tcp -d 202.147.167.99 \
>   --dport 21 -j DNAT --to-destination 192.168.0.5
>
> iptables -A FORWARD -i $EXT_IF -o $INT_IF -p tcp --syn -d 192.168.0.5 \
>   --dport 21 -j ACCEPT
>
> the above assumes you have a rule in FORWARD that accepts established
> packets, such as:
>
> iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
>
> hth...
>
> -j
>
> Thanks in advance!
> Milo
>
> ----- Original Message -----
> From: "Jason Opperisano" <opie@817west.com>
> To: <netfilter@lists.netfilter.org>
> Sent: Wednesday, December 29, 2004 01:30 AM
> Subject: Re: FTP Forwarding
>
>
>> On Tue, 2004-12-28 at 12:19, umar draz wrote:
>> > Hi Dear Members!
>> >
>> >   i have linux machine which configured as a router
>> >
>> >   my linux router has 2 NIC one with Public ip 202.147.167.99 and other
> is local ip 192.168.0.1
>> >   i have a another linux machine which configured as a FTP server and
> that machine ip is 192.168.0.5. Now i want my this ftp server can be 
> access
> all world. so what kind of iptables rules will be add on linux router that
> if some one want to access ftp 202.147.167.99 its automaticaly forward or
> redirect my local machine 192.168.0.5.
>> >
>> >  Please help me in this regard
>> >
>> > Thanks
>> >
>> > Umar
>>
>> modprobe ip_conntrack_ftp
>> modprobe ip_nat_ftp
>>
>> iptables -t nat -A PREROUTING -i $EXT_IF -p tcp -d 202.147.167.99 \
>>   --dport 21 -j DNAT --to-destination 192.168.0.5
>>
>> iptables -A FORWARD -i $EXT_IF -o $INT_IF -p tcp --syn -d 192.168.0.5 \
>>   --dport 21 -j ACCEPT
>>
>> the above assumes you have a rule in FORWARD that accepts established
>> packets, such as:
>>
>> iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
>>
>> hth...
>>
>> -j
>>
>> --
>> "Well, I'm tired of being a wannabe league bowler. I wanna be a
>>  league bowler!"
>> --The Simpsons
>>
>>
>
>
>