Passive FTP sees remote's _internal_ IP!!??
pascal.mail at plouf.fr.eu.org
Mon Nov 27 22:26:18 CET 2006
Maxime Ducharme a écrit :
> This happens when the remote server has a bad
> NAT configuration for FTP.
I fully agree, the problem seems to be on the server side.
> Maybe SonicWALL is able to "fix" this itself, I dont
> know this product very well.
If it does so, I'd be happy to know how.
> some suggestions :
> 1. Fix NAT for FTP on remote firewall
> 2. Configure remote server to explicitly send
> external IP for passive connections (most of FTP
> software allows to configure this)
> 3. Configure your FTP client to use active mode.
> If server is running on another port than 21,
> you must tell ip_nat_ftp to "listen" for FTP
> traffic on this port. Someone on this list can
> tell us how ? (I dont remember how)
$ modprobe ip_conntrack_ftp ports=21,alternate_port
$ modprobe ip_nat_ftp ports=21,alternate_port
Both commands are needed because AFAIK, ip_nat_ftp loads automatically
ip_conntrack_ftp if not already loaded but does not pass the port list
to it. Duh.
3b. Use extended passive mode (EPSV) if the client, the remote server
and their firewall/NATs support it, because an EPSV reply does not
contains the server address.
> -----Message d'origine-----
> De : netfilter-bounces at lists.netfilter.org
> [mailto:netfilter-bounces at lists.netfilter.org] De la part de gypsy
> Envoyé : 27 novembre, 2006 10:33
> À : netfilter at lists.netfilter.org
> Objet : Passive FTP sees remote's _internal_ IP!!??
> We don't think this is a netfilter problem.
I agree, at least not on the client side.
> The kernel should tell the
> remote end that it can't use the "nonroutable" IP - shouldn't it?
No, the kernel is not supposed to do this. All the Netfilter FTP NAT
helper module can do is translate "internal" addresses. However the
wrong PASV reply comes from the outside.
>>>When the default GW is set to the linux box (192.168.223.254) and
>>>passive FTP to a remote server is initiated, the FTP fails after
>>>connection because the internal IP of the remote machine (192.168.1.11)
>>>is seen rather than its external IP. This problem occurs only when
>>>passive FTP is used.
Does this happen with any FTP server or only a specific one ?
More information about the netfilter