I'm lost in IPTABLES PREROUTING, forwarding to another destination port range

lithos · 08-18-2011, 07:24 AM

Hi

I'm running Linux RHEL4 based server with IPTABLES routing/ forwarding a port 55555 (let's say it's 55555) to another IP port 1234 with:

Code:

iptables -t nat -A PREROUTING -p tcp --dport 55555 -j DNAT --to-destination 1.222.333.444:21
iptables -t nat -A POSTROUTING -j MASQUERADE

and so far so good, but the destination IP has a FTP (vsftpd) service running on that port with PASSIVE connections, so I am not able to establish the LIST of directories on the server.

Code:

Retrieving directory listing...
Command:	PWD
Response:	257 "/"
Command:	TYPE I
Response:	200 Switching to Binary mode.
Command:	PASV
Response:	227 Entering Passive Mode (1,222,333,444,203,192)
Command:	LIST

and here it hangs until disconnected from server

How to forward the Passive ports also to that server? Maybe I should forward also the destination port 20 as it's used in Vsftpd for transfer port ? How ?

Kindly asking for help (not man iptables, because I lost the track of trying)

My best regards.

smallpond · 08-18-2011, 11:41 AM

iptables has a special kernel module for FTP NAT.

Code:

modprobe ip_conntrack_ftp
modprobe ip_nat_ftp

Also you need to open ports 20, 21 and the passive ports in iptables:
See this thread:
http://www.linuxquestions.org/questi...d-port-891483/

lithos · 08-18-2011, 02:21 PM

I have

Code:

root@~#>modprobe -c | grep ftp
alias symbol:ip_nat_tftp_hook ip_conntrack_tftp
alias symbol:ip_nat_ftp_hook ip_conntrack_ftp

so I assume that IPTABLES FTP NAT has it.

Also passive ports are opened on the 'destination' server 1,222,333,444 (otherwise I could not connect to it directly)
so the problem is forwarding from the RHEL4 server port 55555 to destination 1,222,333,444 other passive ports.

Do I have forward the passive ports for 1.222.333.444 too, somehow ?

smallpond · 08-18-2011, 08:18 PM

Quote:

Originally Posted by lithos

I have

Code:

root@~#>modprobe -c | grep ftp
alias symbol:ip_nat_tftp_hook ip_conntrack_tftp
alias symbol:ip_nat_ftp_hook ip_conntrack_ftp

so I assume that IPTABLES FTP NAT has it.

Also passive ports are opened on the 'destination' server 1,222,333,444 (otherwise I could not connect to it directly)
so the problem is forwarding from the RHEL4 server port 55555 to destination 1,222,333,444 other passive ports.

Do I have forward the passive ports for 1.222.333.444 too, somehow ?

You either need to forward the passive ports in iptables, or disable passive mode on the server.
That might be simpler if you don't need more than one simultaneous connection.

lithos · 08-19-2011, 05:01 AM

Quote:

need to forward the passive ports in iptables

I'd like to ask if one could give me an example how.

Quote:

or disable passive mode on the server.

not really an option as it's almost never only 1 connection (but many from allowed IP in our company)