Hi,
I am trying to set up a FTP server, on a machine running Debian Testing.

The server is behind a NAT box.

I understand that I need to open ports 20 and 21 on the firewall, and forward these ports to the server from the NAT box. However, the FTP server only works from within my network, so I assume that I am not doing the NAT port forwarding correctly. When I try to login from an external machine, I can login correctly but I can not transfer any data.

I would also like to allow ssh access to this machine. This would be port 22. It works from within the network, but not from an external machine.

What ports do I need to forward from the NAT box to the server in order for this to work?

If I forward all the ports to the server, everything works correctly, however this is not very secure, so what is a better solution.

Thanks in advance
--Ian

Why not launch a sniffer in the LAN and look at a connection initiated from the outside? If you can also put a sniffer on a client (and/or on the outside interface of firewall) , then you will have even more information.

You would know where is your problem for ftp:
-> the client can not reach the data port of the server
-> in case of active ftp, the server is maybe blocked by the firewall : src port 20 (for ftp servers that are standards.. not all) to outside should be opened (to the client only) when an ftp transfer is occuring.
-> in case of passive ftp, maybe the client is blocked by your firewall not opening a port
-> the client tries to connected to your internal IP (192.168.0.1 for example) because your nat is not translating the data in the ftp packet ( the nat has to be ftp aware or worse solution: the server has to send your outside interface IP)

http://slacksite.com/other/ftp.html