Damans227 commented on code in PR #14330:
URL: https://github.com/apache/cloudstack/pull/14330#discussion_r4212640780
##########
systemvm/debian/opt/cloud/bin/cs/CsAddress.py:
##########
@@ -460,6 +460,8 @@ def fw_router(self):
"-A POSTROUTING " +
"-p udp -m udp --dport 68 -j CHECKSUM
--checksum-fill"])
+ self.fw.append(["raw", "", "-A PREROUTING -p tcp -m tcp --dport 21 -j
CT --helper ftp"])
Review Comment:
tested 47e05d4d on kvm with the 4.22.0 systemvm template. vsftpd vm with
default passive settings, curl in passive mode from outside the zone, each
router rebuilt with a clean restart. all six list the folder and the passive
reply carries the public ip.
- isolated, static nat, port 21: pass
- isolated, port forward 21 to 21: pass
- isolated, port forward 2121 to 21: pass
- vpc tier, static nat, port 21: pass
- vpc tier, port forward 21 to 21: pass
- vpc tier, port forward 2121 to 21: pass
raw table on the isolated router (.185 static nat, .186 forward 21, .187
forward 2121). the source nat ip gets no rule and there is no catch-all port 21
rule:
```
-A PREROUTING -d 10.0.56.185/32 -p tcp -m tcp --dport 21 -j CT --helper ftp
-A PREROUTING -d 10.0.56.186/32 -p tcp -m tcp --dport 21 -j CT --helper ftp
-A PREROUTING -d 10.0.56.187/32 -p tcp -m tcp --dport 2121 -j CT --helper ftp
```
vpc router, same layout:
```
-A PREROUTING -d 10.0.56.188/32 -p tcp -m tcp --dport 21 -j CT --helper ftp
-A PREROUTING -d 10.0.56.189/32 -p tcp -m tcp --dport 21 -j CT --helper ftp
-A PREROUTING -d 10.0.56.190/32 -p tcp -m tcp --dport 2121 -j CT --helper ftp
```
the 2121 case replied with 227 Entering Passive Mode (10,0,56,187,41,171).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
