FTP Wont work with ipforwarding (under Linux)!! 1

[UnknownPerson]

Anyone have a clue how to (rapidly and transparently) enable my client computers to use FTP using our Linux gateway?. The problem (I believe) is that the clients send out a PORT command using the internal IP number...

I have seen systems that have some kind of configuration that can counter-measure this problem.

Thanks in advance.

 

[nohair]

Hi,
Not knowing what ftp client you use I cannot offer you specific advice. However, your client should be able to do both active and passive ftp. Try to establish a passive FTP session. If you wish I can describe to you the difference and why ftp is one of the worst protocols ever (IMO), but you're better going here:

http://www.slacksite.com/other/ftp.html

and reading it better than i could explain it.

-Stephen

 

[markharr]

I suspect that the problem lies at the gateway, not the client. For FTP to work with with Network Address Translation (NAT), a FTP port forwarder has to be added to the NAT if you are using IP-Masq.

See here for explanation:

http://www.linux.org.au/LDP/HOWTO/IP-Masquerade-HOWTO/forwarders.html

This is also excellent information which supplements the information in Stephen's post above:

FTP Nightmares

The classic packet filtering problem is FTP. FTP has two modes; the traditional one is called active mode and the more recent one is called passive mode. Web browsers usually default to passive mode, but command-line FTP programs usually default to active mode.

In active mode, when the remote end wants to send a file (or even the results of an ls or dir command) it tries to open a TCP connection to the local machine. This means you can't filter out these TCP connections without breaking active FTP.

If you have the option of using passive mode, then fine; passive mode makes data connections from client to server, even for incoming data. Otherwise, it is recommended that you only allow TCP connections to ports above 1024 and not between 6000 and 6010 (6000 is used for X-Windows).


This excerpt was from the IPChains HOWTO here:

http://www.linux.org.au/LDP/HOWTO/IPCHAINS-HOWTO-5.html#ftp

See how your NAT gateway is configured and try this out.