Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #3358

iptables + NAT + FTP problem

Show all headers | View raw

Hello,
maybe I'm asking something obvious, but have extensively searched the Net
and didn't find any answer...

I have a machine A that needs to communicate with two networks X and Y,
which both have the same address range, say 10.0.9.0/24 (in fact the
networks are more complicated and consist of many subnetworks, but I'm
simplifying the case here). The networks must have the same address range,
because one is a backup system for the other, so I can't change this.

The only solution seems to create a one-to-one NAT between machine A and one
of the networks. I connected machine A directly to network X (there is a
dedicated IP address 10.0.9.100 for that machine on that network), and put
another machine B between machine A and network Y which does the NAT.

eth0 on machine B is connected to machine A and has address 192.168.200.254
(corresponding interface of machine A has address 192.168.200.1), and eth1 is
connected to network Y and has address 10.0.9.100.

On machine B, iptables is doing DNATs and SNATs using a series of rules like
the ones below (example for a single host):

iptables -t nat -A PREROUTING -s 192.168.200.1 -d 10.0.99.1 -j DNAT --to-destination 10.0.9.1
iptables -t nat -A POSTROUTING -s 192.168.200.1 -d 10.0.9.0/24 -j SNAT --to-source 10.0.9.100
iptables -t nat -A PREROUTING -s 10.0.9.0/24 -d 10.0.9.100 -j DNAT --to-destination 192.168.200.1
iptables -t nat -A POSTROUTING -s 10.0.9.1 -d 192.168.200.1 -j SNAT --to-source 10.0.99.1

With this in effect, if machine A wants to communicate with a host 10.0.9.1
in network Y, it connects to the address 10.0.99.1. Per routing table, this
packet is sent to machine B. On machine B the packet is routed to 10.0.9.1
and the source address is set to 10.0.9.100, so the destination host will
see the connecting host's address as 10.0.9.100 and send the reply there.

Similarly the other way - if the host 10.0.9.1 in network Y wants to
communicate with machine A, it connects to 10.0.9.100 (which is actually
machine B's interface connected to that network). Machine B routes the
packet to machine A and sets the source address to 10.0.99.1 so that machine
A will see the connecting host's address as 10.0.99.1.

Everything works fine except - you guess of course ;) - FTP. As both
connecting parties are unaware of the NAT, they send their real IP addresses
in PORT commands. If - for example - 10.0.9.1 is connecting to FTP server on machine A in
passive mode, it gets from the server a PORT command telling it to connect to
192.168.200.1, while it would need 10.0.9.100. In active mode, the server
gets the PORT command from the client telling the server to connect to
10.0.9.1, while the server would need 10.0.99.1.

I was thinking that ip_conntrack_ftp module is supposed to change the
addresses sent in PORT commands appropriately, but even after loading
ip_conntrack and ip_conntrack_ftp modules, nothing changes. The addresses
are sent unchanged to the other party, so in neither passive nor active mode
it is not possible to establish the data connection.

What can I do to make FTP work?

I know, at least for passive mode there is a workaround. I can set another
IP address in the config file of the FTP server, which the server would then
send to the clients. I have applied that and it works, but I can't consider
this a solution, but rather only a makeshift workaround. Also, some FTP
clients - among them, Windows built-in FTP client, which I must use in some
cases - are not capable of using passive mode, so this workaround doesn't
help. I'm looking for a real solution, ie. appropriate change of addresses
on the NAT machine.
-- 
Regards,
   Jaroslaw Rafa
   raj@ap.krakow.pl
--
"In a million years, when kids go to school, they're gonna know: once there
was a Hushpuppy, and she lived with her daddy in the Bathtub."

Back to comp.os.linux.networking | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

iptables + NAT + FTP problem Jaroslaw Rafa <raj@ap.krakow.pl> - 2015-05-27 12:31 +0000
  Re: iptables + NAT + FTP problem Damien Wyart <damien.wyart@free.fr> - 2015-05-27 16:22 +0200
    Re: iptables + NAT + FTP problem Jaros?aw Rafa <raj@ap.krakow.pl> - 2015-05-29 14:57 +0000
  Re: iptables + NAT + FTP problem Denis Corbin <news@edrusb.is-a-geek.org> - 2015-05-27 21:11 +0200
    Re: iptables + NAT + FTP problem Jaros?aw Rafa <raj@ap.krakow.pl> - 2015-05-29 14:42 +0000
      Re: iptables + NAT + FTP problem Denis Corbin <news@edrusb.is-a-geek.org> - 2015-05-29 19:58 +0200
  Re: iptables + NAT + FTP problem detha <detha@foad.co.za> - 2015-05-27 22:33 +0200
    Re: iptables + NAT + FTP problem Jaros?aw Rafa <raj@ap.krakow.pl> - 2015-05-29 14:53 +0000
  Re: iptables + NAT + FTP problem Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2015-06-07 15:46 +0200

csiph-web