Thanks. For the archives, $CHN is PREROUTING -t nat and the modules are ip_nat_ftp and ip_conntrack_ftp<br><br><div class="gmail_quote">On Fri, Jul 24, 2009 at 2:52 PM, Zachary Kotlarek <span dir="ltr"><<a href="mailto:zach@kotlarek.com">zach@kotlarek.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div class="im"><br>
On Jul 24, 2009, at 2:36 PM, Matthew Nuzum wrote:<br>
<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
I mess w/ this at most once per year. Long enough to forget everything.<br>
<br>
I have a machine w/ one internet interface and one private network interface. There are three IPs on the internet interface. I have a virtual machine on the private interface w/ IP 192.168.99.100. I want to be able to FTP to the internet interface at 69.60.125.100 and connect to the ftp server running on the VM.<br>
<br>
I had this working before but that server died. The rule that I used (modified for the correct IPs) is below, but it's not working. Can anyone give a hand?<br>
<br>
iptables -t nat -A PREROUTING -p tcp -i eth0 -d 69.60.125.100 --dport 21 --sport 1024:65535 -j DNAT --to <a href="http://192.168.99.100:21" target="_blank">192.168.99.100:21</a><br>
<br>
I'm using similar rules for http, smtp and pop3 and they work fine. I suspect there is something I forgot to make note of.<br>
<br>
When I try to login via FTP I can connect but I can't list any files. It sits and does nothing for a long time using command line ftp client, using filezilla (which tries passive mode) it says:<br>
</blockquote>
<br>
<br></div>
You need two things:<br>
<br>
1. A rule to allow related traffic:<br>
iptables --append $CHN --match state --state ESTABLISHED,RELATED --jump ACCEPT<br>
<br>
Since FTP opens a second connection -- to some port other than 21 -- to actually transfer data the firewall needs to know to allow that connection, which can only reasonably be accomplished with the RELATED state match.<br>
<br>
2. To load these to kernel modules:<br>
nf_conntrack_ftp<br>
nf_nat_ftp<br>
The first one provides generic FTP connection tracking, so that the RELATED state will match FTP data connections. The second allows the connection tracking to work even across NAT, which will fix the "unroutable address" warning you see in the client (as well as allow less-smart client to connect in passive mode).<br>
<br>
Zach<br>
<br>
<br>_______________________________________________<br>
Cialug mailing list<br>
<a href="mailto:Cialug@cialug.org">Cialug@cialug.org</a><br>
<a href="http://cialug.org/mailman/listinfo/cialug" target="_blank">http://cialug.org/mailman/listinfo/cialug</a><br>
<br></blockquote></div><br><br clear="all"><br>-- <br>Matthew Nuzum<br>newz2000 on freenode, skype, linkedin, <a href="http://identi.ca">identi.ca</a> and twitter<br>