From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Travis Crook" Subject: ftp forward to internal machine Date: Tue, 4 Jun 2002 16:00:13 -0600 Sender: netfilter-admin@lists.samba.org Message-ID: <009201c20c13$347b4140$6702a8c0@mindtrip.com> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_008F_01C20BE0.E99DADC0" Return-path: Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.samba.org This is a multi-part message in MIME format. ------=_NextPart_000_008F_01C20BE0.E99DADC0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hello everyone, I have a firewall configured to forward port 80 traffic to an = internal machine. I was wondering if the same thing is possible with = ftp traffic. The rules I am using are as follows: iptables -A PREROUTING -t nat -i EXTINF -p tcp -d 1.2.3.4 --dport 21 -j = DNAT --to 192.168.2.5:21 iptables -A FORWARD -i EXTINF -p tcp -d 192.168.2.5 --dport 21 ACCEPT iptables -A FORWARD -i EXTINF -o INTIF -p tcp --dport 21 -m state = --state NEW,ESTABLISHED,RELATED -j ACCEPT iptables -t nat -A PREROUTING -i EXTINF -p tcp --dport 21 -d 1.2.3.4 -j = DNAT --to-destination 192.168.2.5:21 iptables -t nat -A POSTROUTING -o INTIF -p tcp --dport 21 -d 192.168.2.5 = -j SNAT --to-source 192.168.2.254 I can connect to the ftp server but then I cannot establish a data = channel between the client and the server.=20 Any help would be appreciated. If you want to see output of anything I = can include it. Thanks Travis Crook Visions Beyond ------=_NextPart_000_008F_01C20BE0.E99DADC0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Hello everyone,

I have a firewall configured to forward port 80 = traffic=20 to an internal machine. I was wondering if the same thing is = possible with=20 ftp traffic. The rules I am using are as follows:

iptables -A PREROUTING -t nat -i EXTINF -p tcp -d 1.2.3.4 --dport = 21 -j=20 DNAT --to 192.168.2.5:21

iptables -A FORWARD -i EXTINF -p tcp -d 192.168.2.5 --dport 21 = ACCEPT

iptables -A FORWARD -i EXTINF -o INTIF -p tcp --dport 21 -m state = --state=20 NEW,ESTABLISHED,RELATED -j ACCEPT

iptables -t nat -A PREROUTING -i EXTINF -p tcp --dport 21 -d = 1.2.3.4 -j=20 DNAT --to-destination 192.168.2.5:21

iptables -t nat -A POSTROUTING -o INTIF -p tcp --dport 21 -d = 192.168.2.5 -j=20 SNAT --to-source 192.168.2.254

I can connect to the ftp server but then I cannot establish a data = channel=20 between the client and the server.

Any help would be appreciated. If you want to see output of = anything=20 I can include it.

Thanks

Travis Crook

Visions Beyond

------=_NextPart_000_008F_01C20BE0.E99DADC0-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Antony Stone Subject: Re: ftp forward to internal machine Date: Tue, 4 Jun 2002 23:12:19 +0100 Sender: netfilter-admin@lists.samba.org Message-ID: <200206042212.g54MCKA09444@Networker.rockstone.co.uk> References: <009201c20c13$347b4140$6702a8c0@mindtrip.com> Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: <009201c20c13$347b4140$6702a8c0@mindtrip.com> Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.samba.org On Tuesday 04 June 2002 11:00 pm, Travis Crook wrote: > Hello everyone, > I have a firewall configured to forward port 80 traffic to an internal > machine. I was wondering if the same thing is possible with ftp traffic. > The rules I am using are as follows: > > iptables -A PREROUTING -t nat -i EXTINF -p tcp -d 1.2.3.4 --dport 21 -j > DNAT --to 192.168.2.5:21 > > iptables -A FORWARD -i EXTINF -p tcp -d 192.168.2.5 --dport 21 ACCEPT > > iptables -A FORWARD -i EXTINF -o INTIF -p tcp --dport 21 -m state --state > NEW,ESTABLISHED,RELATED -j ACCEPT > > iptables -t nat -A PREROUTING -i EXTINF -p tcp --dport 21 -d 1.2.3.4 -j > DNAT --to-destination 192.168.2.5:21 > > iptables -t nat -A POSTROUTING -o INTIF -p tcp --dport 21 -d 192.168.2.5 -j > SNAT --to-source 192.168.2.254 > > I can connect to the ftp server but then I cannot establish a data channel > between the client and the server. You haven't included port 20. Ftp uses port 21 for the control connection, and port 20 for the data connection. You must translate and forward both of them for ftp to work, and even then in these circumstances I think you'll only be able to use passive mode. Antony From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Travis Crook" Subject: Re: ftp forward to internal machine Date: Tue, 4 Jun 2002 16:17:21 -0600 Sender: netfilter-admin@lists.samba.org Message-ID: <00a401c20c15$99254bc0$6702a8c0@mindtrip.com> References: <009201c20c13$347b4140$6702a8c0@mindtrip.com> <200206042212.g54MCKA09444@Networker.rockstone.co.uk> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.samba.org > You haven't included port 20. > I included port 20 and it seems to work fine now. Thanks!! Is is possible to send it over a different port (i.e. 21345 instead of 21, and 20345 instead of 20)? > Ftp uses port 21 for the control connection, and port 20 for the data > connection. You must translate and forward both of them for ftp to work, > and even then in these circumstances I think you'll only be able to use > passive mode. > > > Antony > > From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Omar Castaneda Acosta" Subject: RE: ftp forward to internal machine Date: Tue, 4 Jun 2002 16:23:44 -0600 Sender: netfilter-admin@lists.samba.org Message-ID: <3A5DC36EC1506C40825C05BE65E62AEF0E8B29@neptuno.idea.com.mx> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C20C16.7D0C3AC4" Return-path: content-class: urn:content-classes:message Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: Travis Crook , netfilter@lists.samba.org This is a multi-part message in MIME format. ------_=_NextPart_001_01C20C16.7D0C3AC4 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Why do you have 2 PREROUTING chains? =20 These chains are correct, be sure your ftp NAT modules are loaded with lsmod (ip_conntrack_ftp & ip_nat_ftp) =20 FTPSERVER=3D192.168.2.5 SERVICE=3D21 INTIP=3D192.168.2.254 EXTIP=3D1.2.3.4 =20 # # Let's forward traffic with destination $EXTIP to somewhere else, you can discard the -i $EXTIF if you want # other interfaces to access the service # $IPTABLES -A PREROUTING -t nat -i $EXTIF -p tcp -d $EXTIP --dport $SERVICE -j DNAT --to-destination $FTPSERVER # # Not really necessary if the default gateway on the FTP server is the INTIP on the firewall # $IPTABLES -A POSTROUTING -t nat -o $INTIF -p tcp -d $FTPSERVER --dport $SERVICE -j SNAT --to-source $INTIP # # A MUST, unless your FORWARD policy is default to ACCEPT # $IPTABLES -A FORWARD -i $EXTIF -o $EXTIF -p tcp --dport $SERVICE -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT # # Just in case your INTERNAL policy is default to DROP # $IPTABLES -A FORWARD -o $EXTIF -i $EXTIF -p tcp --dport $SERVICE -m state --state ESTABLISHED,RELATED -j ACCEPT =20 -- Omar =20 -----Original Message----- From: Travis Crook [mailto:travis@visionsbeyond.com] Sent: Tuesday, June 04, 2002 4:00 PM To: netfilter@lists.samba.org Subject: ftp forward to internal machine =20 Hello everyone, I have a firewall configured to forward port 80 traffic to an internal machine. I was wondering if the same thing is possible with ftp traffic. The rules I am using are as follows: =20 iptables -A PREROUTING -t nat -i EXTINF -p tcp -d 1.2.3.4 --dport 21 -j DNAT --to 192.168.2.5:21 =20 iptables -A FORWARD -i EXTINF -p tcp -d 192.168.2.5 --dport 21 ACCEPT =20 iptables -A FORWARD -i EXTINF -o INTIF -p tcp --dport 21 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT =20 iptables -t nat -A PREROUTING -i EXTINF -p tcp --dport 21 -d 1.2.3.4 -j DNAT --to-destination 192.168.2.5:21 =20 iptables -t nat -A POSTROUTING -o INTIF -p tcp --dport 21 -d 192.168.2.5 -j SNAT --to-source 192.168.2.254 =20 I can connect to the ftp server but then I cannot establish a data channel between the client and the server.=20 =20 Any help would be appreciated. If you want to see output of anything I can include it. =20 Thanks =20 Travis Crook Visions Beyond ------_=_NextPart_001_01C20C16.7D0C3AC4 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Why do you have 2 PREROUTING = chains?

These chains are correct, be sure your ftp = NAT modules are loaded with lsmod (ip_conntrack_ftp & = ip_nat_ftp)

=

FTPSERVER=3D192.168.2.5

SERVICE=3D21

INTIP=3D192.168.2.254

EXTIP=3D1.2.3.4

#

# Let’s forward traffic with = destination $EXTIP to somewhere else, you can discard the –i $EXTIF if you = want

# other interfaces to access the = service

#

$IPTABLES –A PREROUTING –t nat = –i $EXTIF –p tcp –d $EXTIP –-dport $SERVICE –j DNAT –-to-destination = $FTPSERVER

#

# Not really necessary if the default gateway = on the FTP server is the INTIP on the = firewall

#

$IPTABLES –A POSTROUTING –t nat = –o $INTIF –p tcp –d $FTPSERVER –-dport $SERVICE –j SNAT –-to-source = $INTIP

#

# A MUST, unless your FORWARD policy is = default to ACCEPT

#

$IPTABLES –A FORWARD –i $EXTIF = –o $EXTIF –p tcp –-dport $SERVICE –m state –-state NEW,ESTABLISHED,RELATED –j = ACCEPT

#<= o:p>

# Just in case your INTERNAL policy is = default to DROP

#<= o:p>

$IPTABLES –A FORWARD –o $EXTIF = –i $EXTIF –p tcp –-dport $SERVICE –m state –-state ESTABLISHED,RELATED –j = ACCEPT

-- Omar

-----Original Message-----
From: Travis Crook = [mailto:travis@visionsbeyond.com]
Sent: Tuesday, June 04, = 2002 4:00 PM
To: = netfilter@lists.samba.org
Subject: ftp forward to = internal machine

Hello everyone,

I have a firewall configured to forward port 80 traffic to an internal machine. I was wondering if the same thing is possible with ftp traffic. The rules I am using are as follows:<= /p>

<= /p>

iptables -A PREROUTING -t nat -i EXTINF -p tcp -d 1.2.3.4 --dport 21 -j DNAT --to 192.168.2.5:21

<= /p>

iptables -A FORWARD -i EXTINF -p tcp -d 192.168.2.5 --dport 21 = ACCEPT<= /p>

<= /p>

iptables -A FORWARD -i EXTINF -o INTIF -p tcp --dport 21 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT<= /p>

<= /p>

iptables -t nat -A PREROUTING -i EXTINF -p tcp --dport 21 -d 1.2.3.4 -j DNAT --to-destination 192.168.2.5:21<= /p>

<= /p>

iptables -t nat -A POSTROUTING -o INTIF -p tcp --dport 21 -d 192.168.2.5 -j SNAT --to-source 192.168.2.254<= /p>

<= /p>

I = can connect to the ftp server but then I cannot establish a data channel between the = client and the server.

<= /p>

Any help would be appreciated. If you want to see output of anything I can = include it.<= /p>

<= /p>

Thanks<= /p>

<= /p>

Travis Crook<= /p>

Visions Beyond

------_=_NextPart_001_01C20C16.7D0C3AC4-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Omar Castaneda Acosta" Subject: RE: ftp forward to internal machine Date: Tue, 4 Jun 2002 16:24:47 -0600 Sender: netfilter-admin@lists.samba.org Message-ID: <3A5DC36EC1506C40825C05BE65E62AEF0E79E7@neptuno.idea.com.mx> Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: content-class: urn:content-classes:message Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: Antony Stone , netfilter@lists.samba.org I've never included port 20 on my firewall rules and both passive and active ftp work fine. -----Original Message----- From: Antony Stone [mailto:Antony@Soft-Solutions.co.uk] Sent: Tuesday, June 04, 2002 4:12 PM To: netfilter@lists.samba.org Subject: Re: ftp forward to internal machine On Tuesday 04 June 2002 11:00 pm, Travis Crook wrote: > Hello everyone, > I have a firewall configured to forward port 80 traffic to an internal > machine. I was wondering if the same thing is possible with ftp traffic. > The rules I am using are as follows: > > iptables -A PREROUTING -t nat -i EXTINF -p tcp -d 1.2.3.4 --dport 21 -j > DNAT --to 192.168.2.5:21 > > iptables -A FORWARD -i EXTINF -p tcp -d 192.168.2.5 --dport 21 ACCEPT > > iptables -A FORWARD -i EXTINF -o INTIF -p tcp --dport 21 -m state --state > NEW,ESTABLISHED,RELATED -j ACCEPT > > iptables -t nat -A PREROUTING -i EXTINF -p tcp --dport 21 -d 1.2.3.4 -j > DNAT --to-destination 192.168.2.5:21 > > iptables -t nat -A POSTROUTING -o INTIF -p tcp --dport 21 -d 192.168.2.5 -j > SNAT --to-source 192.168.2.254 > > I can connect to the ftp server but then I cannot establish a data channel > between the client and the server. You haven't included port 20. Ftp uses port 21 for the control connection, and port 20 for the data connection. You must translate and forward both of them for ftp to work, and even then in these circumstances I think you'll only be able to use passive mode. Antony From mboxrd@z Thu Jan 1 00:00:00 1970 From: Antony Stone Subject: Re: ftp forward to internal machine Date: Tue, 4 Jun 2002 23:26:47 +0100 Sender: netfilter-admin@lists.samba.org Message-ID: <200206042226.g54MQnA10233@Networker.rockstone.co.uk> References: <009201c20c13$347b4140$6702a8c0@mindtrip.com> <200206042212.g54MCKA09444@Networker.rockstone.co.uk> <00a401c20c15$99254bc0$6702a8c0@mindtrip.com> Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: <00a401c20c15$99254bc0$6702a8c0@mindtrip.com> Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.samba.org On Tuesday 04 June 2002 11:17 pm, Travis Crook wrote: > > You haven't included port 20. > > I included port 20 and it seems to work fine now. Thanks!! Is is possible > to send it over a different port (i.e. 21345 instead of 21, and 20345 > instead of 20)? You'd have to nobble the source code of a client or a server (depending on which one you want to think the other end is running on a weird port number) to get this to work. You can't just "ftp ftp.microsoft.com:12345" like you can with http.... Antony. From mboxrd@z Thu Jan 1 00:00:00 1970 From: Antony Stone Subject: Re: ftp forward to internal machine Date: Tue, 4 Jun 2002 23:29:55 +0100 Sender: netfilter-admin@lists.samba.org Message-ID: <200206042229.g54MTuA10411@Networker.rockstone.co.uk> References: <3A5DC36EC1506C40825C05BE65E62AEF0E79E7@neptuno.idea.com.mx> Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: <3A5DC36EC1506C40825C05BE65E62AEF0E79E7@neptuno.idea.com.mx> Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.samba.org On Tuesday 04 June 2002 11:24 pm, Omar Castaneda Acosta wrote: > I've never included port 20 on my firewall rules and both passive and > active ftp work fine. Yeah, but I'll bet you're not translating the service to run on a weird port number, are you ? You're almost certainly using "-m state --state RELATED" to handle port 20 for you. Isn't stateful inspection wonderful :-) Antony From mboxrd@z Thu Jan 1 00:00:00 1970 From: Tom Eastep Subject: Re: ftp forward to internal machine Date: Tue, 4 Jun 2002 15:32:08 -0700 (PDT) Sender: netfilter-admin@lists.samba.org Message-ID: References: <200206042229.g54MTuA10411@Networker.rockstone.co.uk> Mime-Version: 1.0 Return-path: In-Reply-To: <200206042229.g54MTuA10411@Networker.rockstone.co.uk> Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: TEXT/PLAIN; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Antony Stone Cc: "netfilter@lists.samba.org" On Tue, 4 Jun 2002, Antony Stone wrote: > On Tuesday 04 June 2002 11:24 pm, Omar Castaneda Acosta wrote: > > > I've never included port 20 on my firewall rules and both passive and > > active ftp work fine. > > Yeah, but I'll bet you're not translating the service to run on a weird port > number, are you ? > > You're almost certainly using "-m state --state RELATED" to handle port 20 > for you. Isn't stateful inspection wonderful :-) > And also loading ip_conntrack_ftp.o and ip_nat_ftp.o. -Tom -- Tom Eastep \ Shorewall - iptables made easy AIM: tmeastep \ http://www.shorewall.net ICQ: #60745924 \ teastep@shorewall.net From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Travis Crook" Subject: Re: ftp forward to internal machine Date: Tue, 4 Jun 2002 16:29:44 -0600 Sender: netfilter-admin@lists.samba.org Message-ID: <00d701c20c17$53ba61e0$6702a8c0@mindtrip.com> References: <009201c20c13$347b4140$6702a8c0@mindtrip.com> <200206042212.g54MCKA09444@Networker.rockstone.co.uk> <00a401c20c15$99254bc0$6702a8c0@mindtrip.com> <200206042226.g54MQnA10233@Networker.rockstone.co.uk> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.samba.org Thanks a bunch!! This list is great! I think I can get it from here. Travis Crook Visions Beyond ----- Original Message ----- From: "Antony Stone" To: Sent: Tuesday, June 04, 2002 4:26 PM Subject: Re: ftp forward to internal machine > On Tuesday 04 June 2002 11:17 pm, Travis Crook wrote: > > > > You haven't included port 20. > > > > I included port 20 and it seems to work fine now. Thanks!! Is is possible > > to send it over a different port (i.e. 21345 instead of 21, and 20345 > > instead of 20)? > > You'd have to nobble the source code of a client or a server (depending on > which one you want to think the other end is running on a weird port number) > to get this to work. > > You can't just "ftp ftp.microsoft.com:12345" like you can with http.... > > Antony. > > From mboxrd@z Thu Jan 1 00:00:00 1970 From: Antony Stone Subject: Re: ftp forward to internal machine Date: Tue, 4 Jun 2002 23:38:38 +0100 Sender: netfilter-admin@lists.samba.org Message-ID: <200206042238.g54MceA10923@Networker.rockstone.co.uk> References: Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: "netfilter@lists.samba.org" On Tuesday 04 June 2002 11:32 pm, Tom Eastep wrote: > On Tue, 4 Jun 2002, Antony Stone wrote: > > You're almost certainly using "-m state --state RELATED" to handle port > > 20 for you. Isn't stateful inspection wonderful :-) > And also loading ip_conntrack_ftp.o and ip_nat_ftp.o. Well, yes, that's where your stateful inspection comes in, innit ? :-) Antony.