* nat ftp helper bypass
@ 2013-10-08 5:46 Anand Raj Manickam
2013-10-08 7:36 ` Rob Sterenborg (lists)
0 siblings, 1 reply; 6+ messages in thread
From: Anand Raj Manickam @ 2013-10-08 5:46 UTC (permalink / raw)
To: netfilter
Is there a way to bypass nat ftp helper for a few connections and
allow the rest of the FTP connections to NAT with the FTP helper
module ?
The need is to NAT the FTP control and data connections without
conntrack-helpers .
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: nat ftp helper bypass
2013-10-08 5:46 nat ftp helper bypass Anand Raj Manickam
@ 2013-10-08 7:36 ` Rob Sterenborg (lists)
2013-10-08 7:42 ` Anand Raj Manickam
0 siblings, 1 reply; 6+ messages in thread
From: Rob Sterenborg (lists) @ 2013-10-08 7:36 UTC (permalink / raw)
To: Anand Raj Manickam; +Cc: netfilter
On 10/08/2013 07:46 AM, Anand Raj Manickam wrote:
> Is there a way to bypass nat ftp helper for a few connections and
> allow the rest of the FTP connections to NAT with the FTP helper
> module ?
> The need is to NAT the FTP control and data connections without
> conntrack-helpers .
See man iptables, specifically the raw table:
raw:
This table is used mainly for configuring exemptions from
connection tracking in combination with the NOTRACK target. It
registers at the netfilter hooks with higher priority and is thus called
before ip_conntrack, or any other IP tables. It provides the following
built-in chains: PREROUTING (for packets arriving via any network
interface) OUTPUT (for packets generated by local processes)
--
Rob
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: nat ftp helper bypass
2013-10-08 7:36 ` Rob Sterenborg (lists)
@ 2013-10-08 7:42 ` Anand Raj Manickam
2013-10-08 8:17 ` Tom van Leeuwen
2013-10-08 13:43 ` Rob Sterenborg (lists)
0 siblings, 2 replies; 6+ messages in thread
From: Anand Raj Manickam @ 2013-10-08 7:42 UTC (permalink / raw)
To: Rob Sterenborg (lists); +Cc: netfilter
On Tue, Oct 8, 2013 at 1:06 PM, Rob Sterenborg (lists)
<lists@sterenborg.info> wrote:
> On 10/08/2013 07:46 AM, Anand Raj Manickam wrote:
>>
>> Is there a way to bypass nat ftp helper for a few connections and
>> allow the rest of the FTP connections to NAT with the FTP helper
>> module ?
>> The need is to NAT the FTP control and data connections without
>> conntrack-helpers .
>
>
> See man iptables, specifically the raw table:
>
> raw:
> This table is used mainly for configuring exemptions from connection
> tracking in combination with the NOTRACK target. It registers at the
> netfilter hooks with higher priority and is thus called before ip_conntrack,
> or any other IP tables. It provides the following built-in chains:
> PREROUTING (for packets arriving via any network interface) OUTPUT (for
> packets generated by local processes)
>
>
> --
> Rob
>
Thanks for your response Rob.
The setup is a router and I m tryin to SNAT so the choice i have is on
FORWARD / POSTROUTING chain.
I need connection tracking as i need to NAT the traffic without the
nat ftp helper module .
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: nat ftp helper bypass
2013-10-08 7:42 ` Anand Raj Manickam
@ 2013-10-08 8:17 ` Tom van Leeuwen
2013-10-08 8:34 ` Anand Raj Manickam
2013-10-08 13:43 ` Rob Sterenborg (lists)
1 sibling, 1 reply; 6+ messages in thread
From: Tom van Leeuwen @ 2013-10-08 8:17 UTC (permalink / raw)
To: Anand Raj Manickam, Rob Sterenborg (lists); +Cc: netfilter@vger.kernel.org
Unfortunately I don't know how to solve your problem using iptables.
Could you satisfy my curiosity and tell me why you want this? Maybe
there's another path to take.
Regards,
Tom
On 10/08/2013 09:42 AM, Anand Raj Manickam wrote:
> On Tue, Oct 8, 2013 at 1:06 PM, Rob Sterenborg (lists)
> <lists@sterenborg.info> wrote:
>> On 10/08/2013 07:46 AM, Anand Raj Manickam wrote:
>>> Is there a way to bypass nat ftp helper for a few connections and
>>> allow the rest of the FTP connections to NAT with the FTP helper
>>> module ?
>>> The need is to NAT the FTP control and data connections without
>>> conntrack-helpers .
>>
>> See man iptables, specifically the raw table:
>>
>> raw:
>> This table is used mainly for configuring exemptions from connection
>> tracking in combination with the NOTRACK target. It registers at the
>> netfilter hooks with higher priority and is thus called before ip_conntrack,
>> or any other IP tables. It provides the following built-in chains:
>> PREROUTING (for packets arriving via any network interface) OUTPUT (for
>> packets generated by local processes)
>>
>>
>> --
>> Rob
>>
> Thanks for your response Rob.
>
> The setup is a router and I m tryin to SNAT so the choice i have is on
> FORWARD / POSTROUTING chain.
> I need connection tracking as i need to NAT the traffic without the
> nat ftp helper module .
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: nat ftp helper bypass
2013-10-08 8:17 ` Tom van Leeuwen
@ 2013-10-08 8:34 ` Anand Raj Manickam
0 siblings, 0 replies; 6+ messages in thread
From: Anand Raj Manickam @ 2013-10-08 8:34 UTC (permalink / raw)
To: Tom van Leeuwen; +Cc: Rob Sterenborg (lists), netfilter@vger.kernel.org
On Tue, Oct 8, 2013 at 1:47 PM, Tom van Leeuwen
<tom.van.leeuwen@saasplaza.com> wrote:
> Unfortunately I don't know how to solve your problem using iptables.
> Could you satisfy my curiosity and tell me why you want this? Maybe there's
> another path to take.
>
This is a multi link scenario , where on a Passive FTP connection ,
The control connection goes on Link1 and Data Connection goes on
Link2.
If i remove the conntrack helpers (rmmod nf_nat_ftp &
nf_conntrack_ftp) , the behaviour is fine.
> Regards,
> Tom
>
>
> On 10/08/2013 09:42 AM, Anand Raj Manickam wrote:
>>
>> On Tue, Oct 8, 2013 at 1:06 PM, Rob Sterenborg (lists)
>> <lists@sterenborg.info> wrote:
>>>
>>> On 10/08/2013 07:46 AM, Anand Raj Manickam wrote:
>>>>
>>>> Is there a way to bypass nat ftp helper for a few connections and
>>>> allow the rest of the FTP connections to NAT with the FTP helper
>>>> module ?
>>>> The need is to NAT the FTP control and data connections without
>>>> conntrack-helpers .
>>>
>>>
>>> See man iptables, specifically the raw table:
>>>
>>> raw:
>>> This table is used mainly for configuring exemptions from
>>> connection
>>> tracking in combination with the NOTRACK target. It registers at the
>>> netfilter hooks with higher priority and is thus called before
>>> ip_conntrack,
>>> or any other IP tables. It provides the following built-in chains:
>>> PREROUTING (for packets arriving via any network interface) OUTPUT (for
>>> packets generated by local processes)
>>>
>>>
>>> --
>>> Rob
>>>
>> Thanks for your response Rob.
>>
>> The setup is a router and I m tryin to SNAT so the choice i have is on
>> FORWARD / POSTROUTING chain.
>> I need connection tracking as i need to NAT the traffic without the
>> nat ftp helper module .
>> --
>> To unsubscribe from this list: send the line "unsubscribe netfilter" in
>> the body of a message to majordomo@vger.kernel.org
>> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: nat ftp helper bypass
2013-10-08 7:42 ` Anand Raj Manickam
2013-10-08 8:17 ` Tom van Leeuwen
@ 2013-10-08 13:43 ` Rob Sterenborg (lists)
1 sibling, 0 replies; 6+ messages in thread
From: Rob Sterenborg (lists) @ 2013-10-08 13:43 UTC (permalink / raw)
To: Anand Raj Manickam; +Cc: netfilter
On 10/08/2013 09:42 AM, Anand Raj Manickam wrote:
> On Tue, Oct 8, 2013 at 1:06 PM, Rob Sterenborg (lists)
> <lists@sterenborg.info> wrote:
>> On 10/08/2013 07:46 AM, Anand Raj Manickam wrote:
>>>
>>> Is there a way to bypass nat ftp helper for a few connections and
>>> allow the rest of the FTP connections to NAT with the FTP helper
>>> module ?
>>> The need is to NAT the FTP control and data connections without
>>> conntrack-helpers .
>>
>>
>> See man iptables, specifically the raw table:
>>
>> raw:
>> This table is used mainly for configuring exemptions from connection
>> tracking in combination with the NOTRACK target. It registers at the
>> netfilter hooks with higher priority and is thus called before ip_conntrack,
>> or any other IP tables. It provides the following built-in chains:
>> PREROUTING (for packets arriving via any network interface) OUTPUT (for
>> packets generated by local processes)
>>
>>
>> --
>> Rob
>>
> Thanks for your response Rob.
>
> The setup is a router and I m tryin to SNAT so the choice i have is on
> FORWARD / POSTROUTING chain.
> I need connection tracking as i need to NAT the traffic without the
> nat ftp helper module .
Look at these pages:
http://doc.powerdns.com/html/recursor-performance.html
http://www.stearns.org/pomlist/20030101-output/pom-userspace.html#raw
I've never had to use the raw table nor the NOTRACK target so my info is
likely hardly authoritative. But, I guess it would work something like this:
$ipt -t raw -A PREROUTING -d <ip_ftp_server> -p tcp -m multiport \
--dports 20,21 -j NOTRACK
$ipt -t raw -A PREROUTING -s <ip_ftp_server> -p tcp -m multiport \
--dports 20,21 -j NOTRACK
If I understand things correctly, this should make connections to/from
the specified FTP server untracked.
After that, you'd need static NAT rules to forward packets to and from
the FTP server. I don't know if Netfilter does NAT without connection
tracking. If not, then maybe iproute2 can help you there:
http://linux-ip.net/html/nat-stateless.html
--
Rob
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2013-10-08 13:43 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-10-08 5:46 nat ftp helper bypass Anand Raj Manickam
2013-10-08 7:36 ` Rob Sterenborg (lists)
2013-10-08 7:42 ` Anand Raj Manickam
2013-10-08 8:17 ` Tom van Leeuwen
2013-10-08 8:34 ` Anand Raj Manickam
2013-10-08 13:43 ` Rob Sterenborg (lists)
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).