Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #3367

Re: iptables + NAT + FTP problem

Show all headers | View raw

Hello,

Jaroslaw Rafa a écrit :
> 
> On machine B, iptables is doing DNATs and SNATs using a series of rules like
> the ones below (example for a single host):
> 
> iptables -t nat -A PREROUTING -s 192.168.200.1 -d 10.0.99.1 -j DNAT --to-destination 10.0.9.1
> iptables -t nat -A POSTROUTING -s 192.168.200.1 -d 10.0.9.0/24 -j SNAT --to-source 10.0.9.100
> iptables -t nat -A PREROUTING -s 10.0.9.0/24 -d 10.0.9.100 -j DNAT --to-destination 192.168.200.1
> iptables -t nat -A POSTROUTING -s 10.0.9.1 -d 192.168.200.1 -j SNAT --to-source 10.0.99.1

You may consider using NETMAP to simplify the needed rules.

> Everything works fine except - you guess of course ;) - FTP. As both
> connecting parties are unaware of the NAT, they send their real IP addresses
> in PORT commands. If - for example - 10.0.9.1 is connecting to FTP server on machine A in
> passive mode, it gets from the server a PORT command

Err, no. The server does not send any commands, and the PORT or EPRT
command is sent by the client to set (extended) active mode. When the
client sets passive mode with the PASV command, the server sents its
passive address in its reply to this command. Note that using the EPSV
command to set extended passive mode instead of PASV if both the client
and server support it make things easier, because the server does not
send any address : the same address as the one used to establish the
control connection is implied.

> telling it to connect to
> 192.168.200.1, while it would need 10.0.9.100. In active mode, the server
> gets the PORT command from the client telling the server to connect to
> 10.0.9.1, while the server would need 10.0.99.1.
> 
> I was thinking that ip_conntrack_ftp module is supposed to change the
> addresses sent in PORT commands appropriately

No, nf_conntrack_ftp (ip_conntrack_ftp was the old name and is now an
alias) just does the tracking of FTP connections. It does not change
anything but the state of the SYN packet of an FTP data connection from
NEW to RELATED. You also need to load the nf_nat_ftp module to manage
correctly FTP connections with NAT.

Note that these modules do not work with encrypted control connections.

> I know, at least for passive mode there is a workaround. I can set another
> IP address in the config file of the FTP server, which the server would then
> send to the clients.

A similar workaround works for active mode if the client allows to set
the advertised address. Passive and active modes are symmetric.

Back to comp.os.linux.networking | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

iptables + NAT + FTP problem Jaroslaw Rafa <raj@ap.krakow.pl> - 2015-05-27 12:31 +0000
  Re: iptables + NAT + FTP problem Damien Wyart <damien.wyart@free.fr> - 2015-05-27 16:22 +0200
    Re: iptables + NAT + FTP problem Jaros?aw Rafa <raj@ap.krakow.pl> - 2015-05-29 14:57 +0000
  Re: iptables + NAT + FTP problem Denis Corbin <news@edrusb.is-a-geek.org> - 2015-05-27 21:11 +0200
    Re: iptables + NAT + FTP problem Jaros?aw Rafa <raj@ap.krakow.pl> - 2015-05-29 14:42 +0000
      Re: iptables + NAT + FTP problem Denis Corbin <news@edrusb.is-a-geek.org> - 2015-05-29 19:58 +0200
  Re: iptables + NAT + FTP problem detha <detha@foad.co.za> - 2015-05-27 22:33 +0200
    Re: iptables + NAT + FTP problem Jaros?aw Rafa <raj@ap.krakow.pl> - 2015-05-29 14:53 +0000
  Re: iptables + NAT + FTP problem Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2015-06-07 15:46 +0200

csiph-web