Linux Netfilter discussions
 help / color / mirror / Atom feed
* iptables ftp problems; unable to "ls"
@ 2003-11-05 23:40 Han, Yan
  2003-11-06  0:03 ` Frank Smith
  2003-11-06  0:06 ` Alistair Tonner
  0 siblings, 2 replies; 4+ messages in thread
From: Han, Yan @ 2003-11-05 23:40 UTC (permalink / raw)
  To: netfilter


We use a linux server as a firewall and forward packets to different
servers. In this case, we applied the iptables to forward packets from $Fido
to $AtlasFtp for FTP. It is ok that we can log in the ftp server, but unable
to do other things such as "ls", neither does Windows GUI FTP.

Does anyone know why the FTP does not work? (we opened the port 20 and 21
for FTP)? Is there something wrong with ports? 


############    FTP   #########
  iptables -t nat -A PREROUTING -i eth0 --dst $Fido -p tcp --dport $FTP_Port
-j DNAT --to $AtlasFtp
#    iptables -t nat -A PREROUTING -i eth0 --dst $Fido -p udp --dport
$FTP_Port -j DNAT --to $AtlasFtp

    iptables -t nat -A POSTROUTING -p tcp --dst $AtlasFtp --dport $FTP_Port
-j SNAT --to-source $Fido
#    iptables -t nat -A POSTROUTING -p tcp --dst $AtlasFtp --dport $FTP_Port
-j SNAT --to-source $Fido

    iptables -t nat -A OUTPUT --dst $Fido -p tcp --dport $FTP_Port -j DNAT
--to-destination $AtlasFtp
 #   iptables -t nat -A OUTPUT --dst $Fido -p udp --dport $FTP_Port -j DNAT
--to-destination $AtlasFtp



Yan 


^ permalink raw reply	[flat|nested] 4+ messages in thread
* RE: iptables ftp problems; unable to "ls"
@ 2003-11-07 17:51 Han, Yan
  0 siblings, 0 replies; 4+ messages in thread
From: Han, Yan @ 2003-11-07 17:51 UTC (permalink / raw)
  To: 'Alistair@nerdnet.ca', Han, Yan, netfilter

Hello, Alistair,

Thanks for the answer.

I disable 	
modprobe ip_conntrack_ftp 
modprobe ip_nat_ftp

But need a line for "postrouting". 
The ftp does work. What is purpose of these modules? And why should we need
them?


-----Original Message-----
From: Alistair Tonner [mailto:Alistair@nerdnet.ca] 
Sent: Wednesday, November 05, 2003 5:07 PM
To: Han, Yan; netfilter@lists.netfilter.org
Subject: Re: iptables ftp problems; unable to "ls"

On November 5, 2003 06:40 pm, Han, Yan wrote:
> We use a linux server as a firewall and forward packets to different
> servers. In this case, we applied the iptables to forward packets from
> $Fido to $AtlasFtp for FTP. It is ok that we can log in the ftp server,
but
> unable to do other things such as "ls", neither does Windows GUI FTP.
>
> Does anyone know why the FTP does not work? (we opened the port 20 and 21
> for FTP)? Is there something wrong with ports?
>
>
> ############    FTP   #########
>   iptables -t nat -A PREROUTING -i eth0 --dst $Fido -p tcp --dport
> $FTP_Port -j DNAT --to $AtlasFtp
> #    iptables -t nat -A PREROUTING -i eth0 --dst $Fido -p udp --dport
> $FTP_Port -j DNAT --to $AtlasFtp
>
>     iptables -t nat -A POSTROUTING -p tcp --dst $AtlasFtp --dport
$FTP_Port
> -j SNAT --to-source $Fido
> #    iptables -t nat -A POSTROUTING -p tcp --dst $AtlasFtp --dport
> $FTP_Port -j SNAT --to-source $Fido
>
>     iptables -t nat -A OUTPUT --dst $Fido -p tcp --dport $FTP_Port -j DNAT
> --to-destination $AtlasFtp
>  #   iptables -t nat -A OUTPUT --dst $Fido -p udp --dport $FTP_Port -j
DNAT
> --to-destination $AtlasFtp
>
>
>
> Yan
	
	I don't understand all your rules, but the only ones you should need
are 
	the PREROUTING rules.  ip_conntrack_ftp and ip_nat_ftp should handle

	the rest of that natively ... 

	You will need a rule in FORWARD to allow the connection through the
firewall
	after the connection, ESTABLISHED,RELATED will handle the ftp
connections.


	you need to insert 
	modprobe ip_conntrack_ftp 
	modprobe ip_nat_ftp
	
	if you're using a non-standard ftp port use
	modprobe ip_conntrack_ftp ports=(comma separated list of ports to
max 5 
ports) 
	modprobe ip_nat_ftp ports=(comma separated list of ports to max 5
ports)

	(unhh .. that max number may be my kernel only....)
	

-- 

	Alistair Tonner
	nerdnet.ca
	Senior Systems Analyst - RSS
	
     Any sufficiently advanced technology will have the appearance of magic.
	Lets get magical!


^ permalink raw reply	[flat|nested] 4+ messages in thread
end of thread, other threads:[~2003-11-07 17:51 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2003-11-05 23:40 iptables ftp problems; unable to "ls" Han, Yan
2003-11-06  0:03 ` Frank Smith
2003-11-06  0:06 ` Alistair Tonner
  -- strict thread matches above, loose matches on Subject: below --
2003-11-07 17:51 Han, Yan

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox