Date: Sat, 16 Mar 2002 13:42:40 -0500 (EST) From: Marco Radzinschi <marco@radzinschi.com> To: Donnie Jones <donniejones18@yahoo.com> Cc: <freebsd-questions@FreeBSD.ORG> Subject: Re: ftp server and freebsd gateway ( ipnat ) Message-ID: <20020316132946.N61193-100000@mail.radzinschi.com> In-Reply-To: <20020316013151.12f9b698.donniejones18@yahoo.com>
next in thread | previous in thread | raw e-mail | index | archive | help
I have a FreeBSD server behind an OpenBSD gateway/firewall, and it works fine. The only caveat is that clients must use ACTIVE FTP mode, not passive. If you read up on how passive FTP works, you will find that the client connects to a random high port on the server, which your gateway is not forwarding to the FTP servers. The only problem I can see with your setup is that in active mode, the FTP servers open up a connection to port 20 on the client. Their firewall may not be letting port 20 in, in which case active mode will not work for them. If the clients are behind a firewall, they will not be able to connect to your FTP servers unless their firewall has an FTP-PROXY to allow active FTP connections. I will paste the rules on my OpenBSD box below, which work perfectly, with the exception of clients behind firewalls. My apologies for this being in OpenBSD NAT syntax, but it is almost identical to FreeBSD. nat on xl0 from 192.168.1.0/24 to any -> xl0 rdr on xl0 proto tcp from any to any port 21 -> 192.168.1.2 port 21 I would check that your FTP servers can make outbound connections on port 20, and that your users are not connecting from behind firewalls without an FTP-PROXY set up. Marco Radzinschi E-Mail: marco@radzinschi.com AOL IM: CrackedBoy On Sat, 16 Mar 2002, Donnie Jones wrote: > > Hey all. > > I am having some problems with people connecting to my ftp servers behing my FBSD gateway. > > I am using ip nat for my LAN with 3 hosts running ftp servers behing the FBSD gateway. > > IP Addresses for LAN ftp servers: > > 192.168.0.5 -- 1st ftp server > 192.168.0.6 -- 2nd ftp server > 192.168.0.7 -- 3rd ftp server > > To access these ftp servers I am using ip nat's port redirection: > > rdr fxp0 12.220.244.231/32 port 13005 -> 192.168.0.5 port 21 # 1st ftp server > > rdr fxp0 12.220.244.231/32 port 13006 -> 192.168.0.6 port 21 # 2nd ftp server > > rdr fxp0 12.220.244.231/32 port 13007 -> 192.168.0.7 port 21 # 3rd ftp server > > By doing this, a person using ftp can connect to my IP Address at that specific port and then it gets redirected to the correct ftp server behind the FBSD gateway on the LAN. > > Now, this works for some ftp clients, but most of them, especially windows clients, have issues with getting the "list" for their directories, and it just stalls. Eventually, the client will timeout and they are disconnected, therefore, preventing any files to be transferred. > > I am not sure what else can be done to fix this. I've tried having the clients use active and tried passive with no better results. > > Any ideas on things to try to solve this would be wonderful. > > I have attempted to set up an ftp proxy, but I was confused in how to use the program jftpgw. > > If anyone has had success with this program, a sample jftpgw.conf, other than the one that comes with the program, or some url's for online docs would be great for me to look at. > > Also, part of the reason I am asking is that this seems to be a big problem for other users also, and there is not very much documentation available for explanations on how to fix these issues. > > So, I would like to write up a "howto" to facilitate others in this, with the help I receive from this list. > > I have already written a "FBSD gateway howto" available at http://www.darthik.com, under the FreeBSD tab, if anyone would like to take a look at it and give me some comments. > > > Thanks for your time, sorry about the length. > > -Donnie Jones To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020316132946.N61193-100000>