Can't connect to vsFTPd sometimes (timeout), otherwise fantastic (Gentoo)
 

Hi everybody,

I am running a Gentoo virtual machine with Parallels on OSX - my vsFTPd server is running perfectly - except that sometimes I can't connect when I try to connect with a canonical name, maybe 1 out of 3 times - enough to be worrisome. When I connect using the IP address - everything is wonderful, 100% of the time. I have the Gentoo VM on a static IP (10.0.1.201) through my Airport Extreme wireless base station - it's all port-forwarded and works well with all other services. I try to connect (via the canonical name) - no dice - then I do the EXACT SAME THING 2 seconds later - and it works just fine - without making any changes whatsoever. My OSX machine has the IP address of 10.0.1.12, the only thing I can figure think of is that because the VM and my OSX machine are effectively using the same NIC that packets are colliding or something.

Does anybody have any ideas? I've tried lots of stuff, and just can't figure it out.

I thank you all in advance for any assistance that you might be able to offer!

Here's some code to show the problem:

Here's /var/log/vsftpd.log covering the above connections:

(Clearly when I am connecting with the canonical name the Gentoo VM I am connecting from my router (10.0.1.1) indicating that I am actually connecting from the outside world.)


Here's /etc/vsftpd/vsftpd.conf:

Here's my (basic, I know) IPTABLES config (just for completeness):

To start with MAC and IP address pairs are registered once the client gets its DHCP lease and any LAN client will cache those (see 'arp -a'). But charlesread.com is a valid domain name and phobos.charlesread.com a valid host name meaning, unless you prohibit it, the search path (both client and server side) will be: local resolver -> (c,h,b,f,j,i,e,g,l,k,m,a,d).gtld-servers.net (root servers) -> (ns84,ns83).worldnic.com. (authoritative name server). There's several ways to intercept and redirect queries for that specific domain to reach the 'net like putting the guests MAC and IP address pair in /etc/ethers and the IP FQDN pair in /etc/hosts or using a local DNS server like Pdnsd, Dnsmasq, MaraDNS, PowerDNS, ISC BIND, etc, etc but it would be better IMHO, if you own charlesread.com, to distinguish and use say "hostname.charlesread.com.localdomain"-like names inside your LAN to start with.

BTW:
I do hope your router forwards only the necessary ports as you generally speaking don't want MySQL to be accessible over the 'net. (If you don't forward ports now but intend to later on you can limit access already by adding one rule: 'iptables -t filter -I INPUT 3 -m state --state NEW ! -s 10.0.1.0/24 -j REJECT' which would guard against the router becoming a SPOF.) Also note your 8 TCP rules don't use "-m state --state NEW" like they should (why else use conntrack?), you don't filter "-m state --state INVALID" and finally you could replace your 8 TCP rules with one rule if you use "multiport": "-m state --state NEW -m multiport --dports 20:22,25,80,1234,3306,60000:61000" ;-p