FTP problems

FTP problems

[Del Winiecki]

Hi,
Everything seems to work fine except FTP via NAT.
The interfaces that are not natted handle ftp normally.
When I do ftp from inside where the connection goes thru nat, I get an
instant establisment of connection,syn,ack,syn-ack followed by a 30
second wait...then all works normally from that point. This 30 second
delay is constant with each new ftp connection. I have tried about
everything in the iptables script.
Passive ftp does the same thing.
All the other protocols seem okay including IRC.
I am running RedHat kernel 2.4.18-24.7.x i686, iptables version 1.2.5,
all the latest RedHat updates.

I have loaded:
ip_conntrack
ip_conntrack_ftp
ip_conntrack_irc
ip_table_nat
ip_nat_ftp
ip_nat_irc
ipt_state
ipt_limit
ipt_REJECT
ipt_LOG
ipt_unclean
ipt_mac
iptable_filter
iptable_mangle
iptable_nat

Should the ftp connection show up in /proc/net/ip_conntrack ? It does
NOT show in there.
Is there a problem with the ipt_nat_ftp module?
-Del

Re: FTP problems

[Ralf Spenneberg]

Am Don, 2003-02-27 um 21.23 schrieb Del Winiecki:
> Hi,
> Everything seems to work fine except FTP via NAT.
> The interfaces that are not natted handle ftp normally.
> When I do ftp from inside where the connection goes thru nat, I get an
> instant establisment of connection,syn,ack,syn-ack followed by a 30
> second wait...then all works normally from that point. This 30 second
> delay is constant with each new ftp connection. I have tried about
> everything in the iptables script.
> Passive ftp does the same thing.
Might be an issue with identd. Many ftp servers do reverse identd lookups on 
the client. If you drop these on your firewall they have to wait for the timeout.
Reject identd on your firewall:
iptables -A INPUT -p tcp --dport 113 -j REJECT

Other possibility is reverse DNS lookup by the FTP server. 

Cheers,

Ralf
 
> 
-- 
Ralf Spenneberg
RHCE, RHCX

IPsec/PPTP Kernels for Red Hat Linux:  
http://www.spenneberg.com/.net/.org/.de
Honeynet Project Mirror:                http://honeynet.spenneberg.org
Snort Mirror:                           http://snort.spenneberg.org

Re: FTP problems

[Robert Allmeroth]

hello,

I had the same problem.. but it was a DNS problem. Most FTP servers do
a reverse lookup of your IP address and if that fails it takes a while.

Robert

> Everything seems to work fine except FTP via NAT.
> The interfaces that are not natted handle ftp normally.
> When I do ftp from inside where the connection goes thru nat, I get an
> instant establisment of connection,syn,ack,syn-ack followed by a 30
> second wait...then all works normally from that point. This 30 second
> delay is constant with each new ftp connection. I have tried about
> everything in the iptables script.
> Passive ftp does the same thing.
> All the other protocols seem okay including IRC.
> I am running RedHat kernel 2.4.18-24.7.x i686, iptables version 1.2.5,
> all the latest RedHat updates.

> I have loaded:
> ip_conntrack
> ip_conntrack_ftp
> ip_conntrack_irc
> ip_table_nat
> ip_nat_ftp
> ip_nat_irc
> ipt_state
> ipt_limit
> ipt_REJECT
> ipt_LOG
> ipt_unclean
> ipt_mac
> iptable_filter
> iptable_mangle
> iptable_nat

> Should the ftp connection show up in /proc/net/ip_conntrack ? It does
> NOT show in there.
> Is there a problem with the ipt_nat_ftp module?