Hi,

i installed glftpd on my redhat9 machine which has 2 nics ( eth0 is 10.0.0.1 and makes the internet connection ) and the other nic is 192.168.0.100 ( which makes my lan connection to the rest of the network ).

on the same server, which is directly connected to the internet, i installed arno´s iptables. which works just great.

no the problem:

if somebody is connecting to my glftpd server on port 9000 he gets no dirlisting cause of passive mode errors. i added a passive mode port range at the glftp.conf and i nat ip forwarded the same at the iptables script.

does it make any diffrence if i forward it to 192.168.0.100 or 10.0.0.1 ? both are connected to the linux pc.

who can help !!! need fast help !

There are 2 ip netfilter modules which must be manually loaded,
insmod ip_conntrack_ftp &
insmod ip_nat_ftp

to catch the passive port connection properly.
Add these to the script

If glftpd is on the server, the nat rule is -j REDIRECT to send it to localhost

Check the tutorial.

glftpd is on the same pc where iptables is running. into this machine there are 2 nics, one is 192.168.0.100 which makes my lan connection and one nic which makes via ppp0 my internet connection ( 10.0.0.1 )

to which adress i should forward the ports ? to 192.168.0.100 or 10.0.0.1 ?

can u please tell me the full command i should at to my script ? btw, if i add this command, it will be lost the next time i restart my pc, isnt it ?

Whatever rule you are using to DNAT, change it to just -j REDIRECT.

if i think bout this forwarding:

does it make sense at all to forward ports at all ? it makes no sense for me to forward the port to the server its installed ON. i think i should just open up the ports for passive and done or ?

( cant do it right now, cause iam at work )

Quite true...

Try first with the 2 modules loaded and the firewall off,
if it's ok, then start the firewall..

did i have to download these modules first or can i just do insmod ?
are they perm or temp installed then ?!

They are already to use, just insmod them and you need to add them to your start script, usually before any rules.

so there arent permanent i have to put them at rc5 or so to boot up...

is it ok to just add insmod <name> or fully path ?

Put them into the beginning of your iptables script...
Mine are in /etc/init.d/iptables...

]# cat /etc/init.d/iptables
#!/bin/sh
#
# iptables Start iptables firewall
#
# chkconfig: 2345 08 92
# description: Starts, stops and saves iptables firewall
#
# config: /etc/sysconfig/iptables
# config: /etc/sysconfig/iptables-config

# Source function library.
. /etc/init.d/functions

IPTABLES=iptables
IPTABLES_DATA=/etc/sysconfig/$IPTABLES
IPTABLES_CONFIG=/etc/sysconfig/${IPTABLES}-config
IPV=${IPTABLES%tables} # ip for ipv4 | ip6 for ipv6
PROC_IPTABLES_NAMES=/proc/net/${IPV}_tables_names
VAR_SUBSYS_IPTABLES=/var/lock/subsys/$IPTABLES

if [ ! -x /sbin/$IPTABLES ]; then
echo -n $"/sbin/$IPTABLES does not exist."; warning; echo
exit 0
fi

if lsmod 2>/dev/null | grep -q ipchains ; then
echo -n $"ipchains and $IPTABLES can not be used together."; warning; echo
exit 0
fi

# Default firewall configuration:
IPTABLES_MODULES="ip_conntrack_ftp ip_nat_ftp"
IPTABLES_SAVE_ON_STOP="no"
IPTABLES_SAVE_ON_RESTART="no"
IPTABLES_SAVE_COUNTER="no"
IPTABLES_STATUS_NUMERIC="no"

nope..no insmod was needed. just open the tcp ports and it works brilliant!

thx dude !!