Very Computer

by **mmri..** » Sat, 20 Jan 2001 10:44:09

I'm running a linux Firewall (kernel 2.2.17) with IPChains (masq_ftp
installed). It connects the private Network to the Internet. Inside the
private network, there ist a Windows 2000 machine running the FTP-
Server included in the Microsoft IIS. To get a connection from the
internet to the FTP-Server I configured the following portmapping:

/usr/sbin/ipmasqadm portfw -a -P tcp -L $4 8021 -R ftp.xxxxx.de ftp
($4 is the public IP of the firewall, ftp.xxxxx.de the ftp-server)

When I try to get a connection via FTP it works just fine, unless I try
to get some data (ie command "ls"). The client doesn't get any respond.
A tcpdump on the firewall shows the following: The server gets the
request, tries to establish a ftp-data connection but the client
doesn't respond.
I know this is a well known problem because I discovered many articels
about this topic - only help requests, no answers...

Sent via Deja.com
http://www.deja.com/

by **Lac Hao Vie** » Sat, 20 Jan 2001 12:03:29

What client do you have?

> I'm running a linux Firewall (kernel 2.2.17) with IPChains (masq_ftp
> installed). It connects the private Network to the Internet. Inside
the
> private network, there ist a Windows 2000 machine running the FTP-
> Server included in the Microsoft IIS. To get a connection from the
> internet to the FTP-Server I configured the following portmapping:

> /usr/sbin/ipmasqadm portfw -a -P tcp -L $4 8021 -R ftp.xxxxx.de ftp
> ($4 is the public IP of the firewall, ftp.xxxxx.de the ftp-server)

> When I try to get a connection via FTP it works just fine, unless I
try
> to get some data (ie command "ls"). The client doesn't get any
respond.
> A tcpdump on the firewall shows the following: The server gets the
> request, tries to establish a ftp-data connection but the client
> doesn't respond.
> I know this is a well known problem because I discovered many articels
> about this topic - only help requests, no answers...

> Sent via Deja.com
> http://www.deja.com/

Sent via Deja.com
http://www.deja.com/

by **Jem Berke** » Sat, 20 Jan 2001 12:33:12

Quote:> /usr/sbin/ipmasqadm portfw -a -P tcp -L $4 8021 -R ftp.xxxxx.de ftp
> ($4 is the public IP of the firewall, ftp.xxxxx.de the ftp-server)

> When I try to get a connection via FTP it works just fine, unless I try
> to get some data (ie command "ls"). The client doesn't get any respond.
> A tcpdump on the firewall shows the following: The server gets the
> request, tries to establish a ftp-data connection but the client
> doesn't respond.

When you want to do packet forwarding into an internal FTP server you
have to do forwarding of both ports 20 (ftp-data) and 21 (ftp)

You seem to be using a nonstandard port externally, though. I don't know
what the associated ftp-data port would be, perhaps it is still port 20?
Try it out.

--
http://www.pc-tools.net/
DOS, Win32, Linux software

by **Matthias Riechma** » Sat, 20 Jan 2001 19:43:23

Using ports 21 and 20 for forwarding makes no difference. I fear the
masquerading masks the packets coming from the server on port 20 to a
port on the client it doesn't expect. But I don't know which port it
does expect and how to fix it.

Quote:>> /usr/sbin/ipmasqadm portfw -a -P tcp -L $4 8021 -R ftp.xxxxx.de ftp
>> ($4 is the public IP of the firewall, ftp.xxxxx.de the ftp-server)

>> When I try to get a connection via FTP it works just fine, unless I try
>> to get some data (ie command "ls"). The client doesn't get any respond.
>> A tcpdump on the firewall shows the following: The server gets the
>> request, tries to establish a ftp-data connection but the client
>> doesn't respond.

>When you want to do packet forwarding into an internal FTP server you
>have to do forwarding of both ports 20 (ftp-data) and 21 (ftp)

>You seem to be using a nonstandard port externally, though. I don't know
>what the associated ftp-data port would be, perhaps it is still port 20?
>Try it out.

>--
>http://www.pc-tools.net/
>DOS, Win32, Linux software

by **Matthias Riechma** » Sat, 20 Jan 2001 19:45:41

I'm using the standard ftp-command (active mode) on SunOS 5.7.

On Fri, 19 Jan 2001 03:03:29 GMT, Lac Hao Viet

>What client do you have?

>> I'm running a linux Firewall (kernel 2.2.17) with IPChains (masq_ftp
>> installed). It connects the private Network to the Internet. Inside
>the
>> private network, there ist a Windows 2000 machine running the FTP-
>> Server included in the Microsoft IIS. To get a connection from the
>> internet to the FTP-Server I configured the following portmapping:

>> /usr/sbin/ipmasqadm portfw -a -P tcp -L $4 8021 -R ftp.xxxxx.de ftp
>> ($4 is the public IP of the firewall, ftp.xxxxx.de the ftp-server)

>> When I try to get a connection via FTP it works just fine, unless I
>try
>> to get some data (ie command "ls"). The client doesn't get any
>respond.
>> A tcpdump on the firewall shows the following: The server gets the
>> request, tries to establish a ftp-data connection but the client
>> doesn't respond.
>> I know this is a well known problem because I discovered many articels
>> about this topic - only help requests, no answers...

>> Sent via Deja.com
>> http://www.deja.com/

>Sent via Deja.com
>http://www.deja.com/

Very Computer

IIS-ftp-server behind linux firewall

IIS-ftp-server behind linux firewall

IIS-ftp-server behind linux firewall

IIS-ftp-server behind linux firewall

IIS-ftp-server behind linux firewall

IIS-ftp-server behind linux firewall