LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 01-30-2009, 11:32 AM   #1
dont_stop_me
Member
 
Registered: Sep 2005
Location: Romania
Distribution: Slackware 12
Posts: 42

Rep: Reputation: 15
ftp routing problem on linux server


Hi,
I have a simple NAT server and it does not let through active FTP connections.
I use slackware 12.2 with standard kernel.
Here is my script :
Code:
iptables -F
iptables -t nat -F

iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source aaa.bbb.ccc.ddd
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth1 -m state --state NEW -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
did I miss something?
What should I do?
 
Old 01-30-2009, 12:04 PM   #2
kentyler
Member
 
Registered: Dec 2008
Location: Cleveland Ohio
Distribution: CentOS
Posts: 235

Rep: Reputation: 36
Do you have ip forwarding enabled?

What are the outputs of the following?

/proc/sys/net/ipv4/ip_forward

/proc/sys/net/ipv4/conf/all/forwarding

/proc/sys/net/ipv4/conf/*/forwarding
 
Old 01-30-2009, 12:15 PM   #3
dont_stop_me
Member
 
Registered: Sep 2005
Location: Romania
Distribution: Slackware 12
Posts: 42

Original Poster
Rep: Reputation: 15
They all are 1. I managed to get the internet working, I only had problems with active ftp.
 
Old 01-31-2009, 12:46 PM   #4
baldy3105
Member
 
Registered: Jan 2003
Location: Cambridgeshire, UK
Distribution: Mint (Desktop), Debian (Server)
Posts: 876

Rep: Reputation: 184Reputation: 184
In active FTP the control session is opened Client dynamic port to Server well known port(21). When you initiate a transfer the client opens a dynamic passive port and informs the servers of that port number. The server then connects to the client on that port to shift the data along.

So if your server is on the outside of your NAT its data connection is going to bounce off of the NAT translation table as the NAT device has no knowledge of the passive open port. To make this work the NAT device would need to be able to snoop on the control connection to see what port was agreed on between the client and the server. As far as I know this is not possible, and is what passive FTP was invented to get around anyway.

So use passive mode FTP and all will be well.
 
Old 02-01-2009, 12:45 AM   #5
dont_stop_me
Member
 
Registered: Sep 2005
Location: Romania
Distribution: Slackware 12
Posts: 42

Original Poster
Rep: Reputation: 15
the solution

Hi,
thanks for your replies, baldy3105 you are right about active FTP, but there is a workaround. I did some reading and if you enable these two kernel modules, the computers behind the NAT can create active ftp connections.

ip_nat_ftp
ip_conntrack_ftp
 
Old 02-01-2009, 02:41 PM   #6
baldy3105
Member
 
Registered: Jan 2003
Location: Cambridgeshire, UK
Distribution: Mint (Desktop), Debian (Server)
Posts: 876

Rep: Reputation: 184Reputation: 184
Cool! Linux just never stops impressing me :-)
 
  


Reply

Tags
behind, ftp, nat


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Routing for a 12 interface ftp server - downloading problem mediaeast Linux - Networking 3 06-21-2007 07:19 AM
ftp from LInux to Serv-U ftp server problem csross Linux - General 2 11-07-2005 04:35 PM
FTP Slow responce maybe routing problem? BinaryBob Linux - Networking 2 12-06-2004 03:00 AM
routing ftp connections to internal server? steepcreep Linux - Networking 1 02-18-2004 02:29 AM
ftp to Linux server problem, help. xman Linux - General 4 12-04-2002 08:14 AM


All times are GMT -5. The time now is 02:45 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration