FTP passive not working

FTP passive not working

[Michael Gale]

Hello,
	
	I am having trouble getting a FTP connection to work in passive mode from
behind a firewall.

	I on the FTP server I have two IP's one used for internal connections and one
used for external connections. The external one is .36 .. so in the proftpd.conf
file I used the following:

<VirtualHost IP.36>
        ServerName "ftp.domain.com"
        MasqueradeAddress       extip.36       
        IdentLookups            off
        AllowOverwrite                  on
        ExtendedLog /var/log/proftpdvh1.log read,write
        TransferLog   /var/log/proftpdvh1-trans.log
</VirtualHost>

So when I try passive my client tried to connect to the external IP of the
firewall on a port > 1024.

On the firewall ( where I believe the problem is) I have some strange settings.
Since I have a large amount of IP's externally and internally I have done this:

All external IP's are mapped to the corrasponding internal IP. So if externally
I had 192.168.7.36 and internally I had 10.10.1.36

I have: (EXTRANGE.$i is the external IP)

$IPT -N tablerule-$i
$IPT -A INPUT -i $EXT_FACE -d $EXTRANGE.$i -j tablerule-$i
$IPT -A OUTPUT -o $EXT_FACE -s $EXTRANGE.$i -j tablerule-$i
$IPT -A FORWARD -i $EXT_FACE -o $INT_FACE -d $INTRANGE.$i -j tablerule-$i
$IPT -A FORWARD -i $INT_FACE -o $EXT_FACE -s $INTRANGE.$i -j tablerule-$i

So all rules with regards to this IP / PC are under one rule.

This setup is working fine for all connections accept passive FTP -- it seems
the firewall is not forwarding the related data connection to the internal
server.

Oh, I also have PREROUTING rules allowing all connections to .36 to be DNAT to
internal .36 well testing.

-- 
Michael Gale
Network Administrator
Utilitran Corporation

Re: FTP passive not working

[Rob Sterenborg]

On Tue, 2004-04-13 at 19:41, Michael Gale wrote:
> Hello,
> 	
> 	I am having trouble getting a FTP connection to work in passive mode from
> behind a firewall.

....

> So all rules with regards to this IP / PC are under one rule.
> 
> This setup is working fine for all connections accept passive FTP -- it seems
> the firewall is not forwarding the related data connection to the internal
> server.

Did you load the ip_conntrack_ftp and ip_nat_ftp modules ?


Gr,
Rob

Re: FTP passive not working

[Michael Gale]

Hello,

	I have all the iptable modules built into the kernel. I also forgot to add the
for the custom tablerule I have allowed all established and related connections.

Michael.


On Tue, 13 Apr 2004 19:59:53 +0200
Rob Sterenborg <rob@sterenborg.info> wrote:

> On Tue, 2004-04-13 at 19:41, Michael Gale wrote:
> > Hello,
> > 	
> > 	I am having trouble getting a FTP connection to work in passive mode
> > 	from
> > behind a firewall.
> 
> ....
> 
> > So all rules with regards to this IP / PC are under one rule.
> > 
> > This setup is working fine for all connections accept passive FTP -- it
> > seems the firewall is not forwarding the related data connection to the
> > internal server.
> 
> Did you load the ip_conntrack_ftp and ip_nat_ftp modules ?
> 
> 
> Gr,
> Rob
> 
> 
> 
> 
> 
> 
> 


-- 
Michael Gale
Network Administrator
Utilitran Corporation

Re: FTP passive not working

[Michael Gale]

Hello again,

	It seems that on tablerule-36 (custom user chain) the --state RELATED does not
work ?

If I add a rule allowing all traffic it works ?

Michael.


On Tue, 13 Apr 2004 13:13:36 -0600
Michael Gale <michael.gale@utilitran.com> wrote:

> Hello,
> 
> 	I have all the iptable modules built into the kernel. I also forgot to
> 	add the
> for the custom tablerule I have allowed all established and related
> connections.
> 
> Michael.
> 
> 
> On Tue, 13 Apr 2004 19:59:53 +0200
> Rob Sterenborg <rob@sterenborg.info> wrote:
> 
> > On Tue, 2004-04-13 at 19:41, Michael Gale wrote:
> > > Hello,
> > > 	
> > > 	I am having trouble getting a FTP connection to work in passive mode
> > > 	from
> > > behind a firewall.
> > 
> > ....
> > 
> > > So all rules with regards to this IP / PC are under one rule.
> > > 
> > > This setup is working fine for all connections accept passive FTP -- it
> > > seems the firewall is not forwarding the related data connection to the
> > > internal server.
> > 
> > Did you load the ip_conntrack_ftp and ip_nat_ftp modules ?
> > 
> > 
> > Gr,
> > Rob
> > 
> > 
> > 
> > 
> > 
> > 
> > 
> 
> 
> -- 
> Michael Gale
> Network Administrator
> Utilitran Corporation
> 
> 
> 
> 
> 


-- 
Michael Gale
Network Administrator
Utilitran Corporation

Re: FTP passive not working

[Michael Gale]

Hi,

	The log files from the LOG target show that the OUT interface for packets
coming after the passive command is issue to be the exteranl interface, which is
wrong since all other commands show the out interface as eth1 the internal nic.

Michael.


On Tue, 13 Apr 2004 13:43:34 -0600
Michael Gale <michael.gale@utilitran.com> wrote:

> Hello again,
> 
> 	It seems that on tablerule-36 (custom user chain) the --state RELATED
> 	does not
> work ?
> 
> If I add a rule allowing all traffic it works ?
> 
> Michael.
> 
> 
> On Tue, 13 Apr 2004 13:13:36 -0600
> Michael Gale <michael.gale@utilitran.com> wrote:
> 
> > Hello,
> > 
> > 	I have all the iptable modules built into the kernel. I also forgot to
> > 	add the
> > for the custom tablerule I have allowed all established and related
> > connections.
> > 
> > Michael.
> > 
> > 
> > On Tue, 13 Apr 2004 19:59:53 +0200
> > Rob Sterenborg <rob@sterenborg.info> wrote:
> > 
> > > On Tue, 2004-04-13 at 19:41, Michael Gale wrote:
> > > > Hello,
> > > > 	
> > > > 	I am having trouble getting a FTP connection to work in passive mode
> > > > 	from
> > > > behind a firewall.
> > > 
> > > ....
> > > 
> > > > So all rules with regards to this IP / PC are under one rule.
> > > > 
> > > > This setup is working fine for all connections accept passive FTP -- it
> > > > seems the firewall is not forwarding the related data connection to the
> > > > internal server.
> > > 
> > > Did you load the ip_conntrack_ftp and ip_nat_ftp modules ?
> > > 
> > > 
> > > Gr,
> > > Rob
> > > 
> > > 
> > > 
> > > 
> > > 
> > > 
> > > 
> > 
> > 
> > -- 
> > Michael Gale
> > Network Administrator
> > Utilitran Corporation
> > 
> > 
> > 
> > 
> > 
> 
> 
> -- 
> Michael Gale
> Network Administrator
> Utilitran Corporation
> 
> 
> 
> 
> 


-- 
Michael Gale
Network Administrator
Utilitran Corporation

Re: FTP passive not working

[Michael Gale]

Nevermind --- not sure why it is not working --- I was able to get it to work by
setting a port range for passive on the FTP server and then forwarding the port
range to the FTP server.

Michael.

On Tue, 13 Apr 2004 14:08:48 -0600
Michael Gale <michael.gale@utilitran.com> wrote:

> Hi,
> 
> 	The log files from the LOG target show that the OUT interface for
> 	packets
> coming after the passive command is issue to be the exteranl interface, which
> is wrong since all other commands show the out interface as eth1 the internal
> nic.
> 
> Michael.
> 
> 
> On Tue, 13 Apr 2004 13:43:34 -0600
> Michael Gale <michael.gale@utilitran.com> wrote:
> 
> > Hello again,
> > 
> > 	It seems that on tablerule-36 (custom user chain) the --state RELATED
> > 	does not
> > work ?
> > 
> > If I add a rule allowing all traffic it works ?
> > 
> > Michael.
> > 
> > 
> > On Tue, 13 Apr 2004 13:13:36 -0600
> > Michael Gale <michael.gale@utilitran.com> wrote:
> > 
> > > Hello,
> > > 
> > > 	I have all the iptable modules built into the kernel. I also forgot to
> > > 	add the
> > > for the custom tablerule I have allowed all established and related
> > > connections.
> > > 
> > > Michael.
> > > 
> > > 
> > > On Tue, 13 Apr 2004 19:59:53 +0200
> > > Rob Sterenborg <rob@sterenborg.info> wrote:
> > > 
> > > > On Tue, 2004-04-13 at 19:41, Michael Gale wrote:
> > > > > Hello,
> > > > > 	
> > > > > 	I am having trouble getting a FTP connection to work in passive
> > > > > 	mode from
> > > > > behind a firewall.
> > > > 
> > > > ....
> > > > 
> > > > > So all rules with regards to this IP / PC are under one rule.
> > > > > 
> > > > > This setup is working fine for all connections accept passive FTP --
> > > > > it seems the firewall is not forwarding the related data connection to
> > > > > the internal server.
> > > > 
> > > > Did you load the ip_conntrack_ftp and ip_nat_ftp modules ?
> > > > 
> > > > 
> > > > Gr,
> > > > Rob
> > > > 
> > > > 
> > > > 
> > > > 
> > > > 
> > > > 
> > > > 
> > > 
> > > 
> > > -- 
> > > Michael Gale
> > > Network Administrator
> > > Utilitran Corporation
> > > 
> > > 
> > > 
> > > 
> > > 
> > 
> > 
> > -- 
> > Michael Gale
> > Network Administrator
> > Utilitran Corporation
> > 
> > 
> > 
> > 
> > 
> 
> 
> -- 
> Michael Gale
> Network Administrator
> Utilitran Corporation
> 
> 
> 
> 
> 


-- 
Michael Gale
Network Administrator
Utilitran Corporation

Re: FTP passive not working

[Antony Stone]

On Tuesday 13 April 2004 6:41 pm, Michael Gale wrote:

> Hello,
>
> I am having trouble getting a FTP connection to work in passive mode from
> behind a firewall.
>
> On the FTP server I have two IP's one used for internal connections and one
> used for external connections. The external one is .36 .. so in the
> proftpd.conf file I used the following:

<snip...>

> So when I try passive my client tried to connect to the external IP of the
> firewall on a port > 1024.

1. Where is the client, which is connecting to the external address?

2. Do passive connections to this server work from your LAN, not going through 
the firewall?

3. Do passive connections to external servers, from clients on your LAN, work 
through the firewall?

Regards,

Antony.

-- 
Never write it in Perl if you can do it in Awk.
Never do it in Awk if sed can handle it.
Never use sed when tr can do the job.
Never invoke tr when cat is sufficient.
Avoid using cat whenever possible.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: FTP passive not working

[Michael Gale]

Hello,

	Passive connections to the client work on the local LAN but they are connecting
to a different IP on the box -- because the server will return the external IP
of the firewall for passive connections to the main IP.

I am sure that the problem is that "RELATED" option under state do not work with
a user defined chain.

iptables -A userchain -i external -o internal -d internalIP -m state --state
ESTABLISHED,RELATED -j ACCEPT.

Michael.


On Tue, 13 Apr 2004 20:37:35 +0100
Antony Stone <Antony@Soft-Solutions.co.uk> wrote:

> On Tuesday 13 April 2004 6:41 pm, Michael Gale wrote:
> 
> > Hello,
> >
> > I am having trouble getting a FTP connection to work in passive mode from
> > behind a firewall.
> >
> > On the FTP server I have two IP's one used for internal connections and one
> > used for external connections. The external one is .36 .. so in the
> > proftpd.conf file I used the following:
> 
> <snip...>
> 
> > So when I try passive my client tried to connect to the external IP of the
> > firewall on a port > 1024.
> 
> 1. Where is the client, which is connecting to the external address?
> 
> 2. Do passive connections to this server work from your LAN, not going through
> the firewall?
> 
> 3. Do passive connections to external servers, from clients on your LAN, work 
> through the firewall?
> 
> Regards,
> 
> Antony.
> 
> -- 
> Never write it in Perl if you can do it in Awk.
> Never do it in Awk if sed can handle it.
> Never use sed when tr can do the job.
> Never invoke tr when cat is sufficient.
> Avoid using cat whenever possible.
> 
>                                                      Please reply to the list;
>                                                            please don't CC me.
> 
> 
> 
> 
> 
> 


-- 
Michael Gale
Network Administrator
Utilitran Corporation

Re: FTP passive not working

[Antony Stone]

On Tuesday 13 April 2004 8:47 pm, Michael Gale wrote:

> Hello,
>
> 	Passive connections to the client work on the local LAN but they are
> connecting to a different IP on the box -- because the server will return
> the external IP of the firewall for passive connections to the main IP.

Yes, I knew that would connect to the other IP on the server - I just wanted 
to check that the server was supporting passive connections :)

> I am sure that the problem is that "RELATED" option under state do not work
> with a user defined chain.

Uh?

> iptables -A userchain -i external -o internal -d internalIP -m state
> --state ESTABLISHED,RELATED -j ACCEPT

Nothing wrong with that.   No reason at all you can't match those parameters 
in a user-defined chain.

I'm not aware of anything in netfilter you can do on a built-in chain which 
you can't do on a user-defined chain except apply a default policy.

Regards,

Antony.

-- 
I don't know, maybe if we all waited then cosmic rays would write all our 
software for us. Of course it might take a while.

 - Ron Minnich, Los Alamos National Laboratory

                                                     Please reply to the list;
                                                           please don't CC me.