[Proftpd-user] Passive mode and NAT (classic ?)

[Marc MENDEZ]

Hi,

An other problem I can't solve :( :

My proftpd server is behind a firewall (you see what is my problem ?...)

I activate Mascarade and so on... So, when I connect to my server from
outside my network (but with a REAL ftp client tool !! in passive mode), I
can do anything.

AllowForeignAddress on
MasqueradeAddress 195.115.75.187 # my public IP
PassivePorts 60000 65535


But, with "classic" tool such as IE or explorer, I can't even have a list
!!!!

Unfortunately, I can't urge my customers to use something else than IE or
Explorer....

BTW, the ports range are opened on my router....


Grrrr !!!!! I will hang proftp !






___________________________________________________________________________
Découvrez un nouveau moyen de poser toutes vos questions quelque soit le sujet !
Yahoo! Questions/Réponses pour partager vos connaissances, vos opinions et vos expériences.
http://fr.answers.yahoo.com

[dan1]

Post by Marc MENDEZ
Hi,
My proftpd server is behind a firewall (you see what is my problem ?...)
I activate Mascarade and so on... So, when I connect to my server from
outside my network (but with a REAL ftp client tool !! in passive mode), I
can do anything.
AllowForeignAddress on
MasqueradeAddress 195.115.75.187 # my public IP
PassivePorts 60000 65535
But, with "classic" tool such as IE or explorer, I can't even have a list
!!!!
Unfortunately, I can't urge my customers to use something else than IE or
Explorer....
BTW, the ports range are opened on my router....
Grrrr !!!!! I will hang proftp !

Hello, Marc.

One minute before hanging..

Supposing that you are using iptables as firewall, here is the setup that I
have made to make the passive mode work on my server, and it should be quite
secure because it doesn't allow source ports but only destination ports,
which are given through the ftp communication before.
Here it is:

# For passive FTP only:
/sbin/insmod ip_conntrack_ftp
/sbin/insmod ip_nat_ftp

# FTP connection and data + passive mode (second line) (setup FTP server
accordingly):
$IPTABLES -A INPUT -p tcp -m tcp --dport 20:21 -j ACCEPT
$IPTABLES -A INPUT -p tcp -m tcp --dport 60000:65535 -j ACCEPT


Hope this helps you.
Daniel

[Matus UHLAR - fantomas]

Post by dan1

Post by Marc MENDEZ
My proftpd server is behind a firewall (you see what is my problem ?...)
I activate Mascarade and so on... So, when I connect to my server from
outside my network (but with a REAL ftp client tool !! in passive mode), I
can do anything.
AllowForeignAddress on
MasqueradeAddress 195.115.75.187 # my public IP
PassivePorts 60000 65535
But, with "classic" tool such as IE or explorer, I can't even have a list
!!!!

I wouldn't call those two "classic" ;)
aren't they behind firewall too?

Post by dan1

Post by Marc MENDEZ
BTW, the ports range are opened on my router....

Supposing that you are using iptables as firewall, here is the setup that I
have made to make the passive mode work on my server, and it should be quite
secure because it doesn't allow source ports but only destination ports,
which are given through the ftp communication before.
/sbin/insmod ip_conntrack_ftp
/sbin/insmod ip_nat_ftp
# FTP connection and data + passive mode (second line) (setup FTP server
$IPTABLES -A INPUT -p tcp -m tcp --dport 20:21 -j ACCEPT
$IPTABLES -A INPUT -p tcp -m tcp --dport 60000:65535 -j ACCEPT

I guess the second one could be replaced by

$IPTABLES -A INPUT -p tcp -m tcp --state ESTABLISHED,RELATED -j ACCEPT

which should be more effective/safe.

[Marc MENDEZ]

----- Original Message -----
From: "Matus UHLAR - fantomas" <***@fantomas.sk>
To: <proftp-***@lists.sourceforge.net>
Sent: Friday, August 04, 2006 11:34 AM
Subject: Re: [Proftpd-user] Passive mode and NAT (classic ?)

Post by Matus UHLAR - fantomas
I wouldn't call those two "classic" ;)
aren't they behind firewall too?

Yes they are ! And I think it's the reason !







___________________________________________________________________________
Découvrez un nouveau moyen de poser toutes vos questions quelque soit le sujet !
Yahoo! Questions/Réponses pour partager vos connaissances, vos opinions et vos expériences.
http://fr.answers.yahoo.com

[Matus UHLAR - fantomas]

Post by Marc MENDEZ

Post by Matus UHLAR - fantomas
I wouldn't call those two "classic" ;)
aren't they behind firewall too?

Yes they are ! And I think it's the reason !

Of course there is a problem with FTP if both the server and client are behind
firewall. At least one of them must support and be configured to pass FTP
data connections, otherwise they CAN NOT transfer any data, nor directory
listings.

I posted recommendation how to do that on linux firewall/router