ftp routing problem on linux server

dont_stop_me · 01-30-2009, 12:32 PM

Hi,
I have a simple NAT server and it does not let through active FTP connections.
I use slackware 12.2 with standard kernel.
Here is my script :

Code:

iptables -F
iptables -t nat -F

iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source aaa.bbb.ccc.ddd
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth1 -m state --state NEW -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT

did I miss something?
What should I do?

kentyler · 01-30-2009, 01:04 PM

Do you have ip forwarding enabled?

What are the outputs of the following?

/proc/sys/net/ipv4/ip_forward

/proc/sys/net/ipv4/conf/all/forwarding

/proc/sys/net/ipv4/conf/*/forwarding

dont_stop_me · 01-30-2009, 01:15 PM

They all are 1. I managed to get the internet working, I only had problems with active ftp.

baldy3105 · 01-31-2009, 01:46 PM

In active FTP the control session is opened Client dynamic port to Server well known port(21). When you initiate a transfer the client opens a dynamic passive port and informs the servers of that port number. The server then connects to the client on that port to shift the data along.

So if your server is on the outside of your NAT its data connection is going to bounce off of the NAT translation table as the NAT device has no knowledge of the passive open port. To make this work the NAT device would need to be able to snoop on the control connection to see what port was agreed on between the client and the server. As far as I know this is not possible, and is what passive FTP was invented to get around anyway.

So use passive mode FTP and all will be well.

dont_stop_me · 02-01-2009, 01:45 AM

Hi,
thanks for your replies, baldy3105 you are right about active FTP, but there is a workaround. I did some reading and if you enable these two kernel modules, the computers behind the NAT can create active ftp connections.

ip_nat_ftp
ip_conntrack_ftp

baldy3105 · 02-01-2009, 03:41 PM

Cool! Linux just never stops impressing me :-)