Impossible to Nat to certain FTP servers

ngwasuma · 07-21-2006, 10:48 AM

Code:

#!/bin/sh
#
# This script will be executed *after* all the other init scripts.
# You can put your own initialization stuff in here if you don't
# want to do the full Sys V style init stuff.

touch /var/lock/subsys/local

# Enable Port forwarding 
echo 1 > /proc/sys/net/ipv4/ip_forward

# Drop ICMP echo-request messages sent to broadcast or multicast addresses
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

# Drop source routed packets
echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route

# Enable TCP SYN cookie protection from SYN floods
echo 1 > /proc/sys/net/ipv4/tcp_syncookies

# Don't accept ICMP redirect messages
echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects

# Don't send ICMP redirect messages
echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects

# Enable source address spoofing protection
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter


iptables --flush
iptables --table nat --flush
iptables --delete-chain
iptables --table nat --delete-chain

# Masquerade
iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE
iptables --append FORWARD --in-interface eth1 -j ACCEPT

Above are the contents of my /etc/rc.local in my Fedora Core 5 Linux NAT box.

Does any one know why it would not Nat connections to certain FTP servers? When I give my client Public IPs that bypass my Nat box, he connects well to his FTP server but not throught the Nat box.

bbeers · 07-22-2006, 05:50 PM

what does lsmod output?

you will need modules for iptables nat and conntrack loaded:
here are some I see on my masquerading router ...

ip_nat_irc 2176 0
ip_nat_ftp 2816 0
ip_conntrack_irc 70800 1 ip_nat_irc
ip_conntrack_ftp 71568 1 ip_nat_ftp
ipt_MASQUERADE 2816 1
iptable_nat 20060 4 ip_nat_irc,ip_nat_ftp,ipt_MASQUERADE
ip_conntrack 38296 6 ip_nat_irc,ip_nat_ftp,ip_conntrack_irc,ip_conntrack_ftp,ipt_MASQUERADE,iptable_nat
iptable_filter 2432 1
ip_tables 20096 3 ipt_MASQUERADE,iptable_nat,iptable_filter