/* HINT: Search archives @ http://www.indyramp.com/masq/ before posting! */


This question has been asked before but with little in the way of a
definitive answer.  Any information is appreciated.

Scenario:

           10.x.x.x/27              192.168.x.x/24
Internet <-------------> Firewall <----------------> FTP Server
                          ipchains
                          ipmasqadm portfw

Firewall interfaces:
eth0 = firewall.domain = 10.x.x.1
eth0:0 = ftp.domain = 10.x.x.2
eth1 = internal interface = 192.168.x.1

I have setup an FTP Server on a private segment and am using ipmasqadm
to portfw 10.x.x.x:21 to my internal FTP server.  The control connection
is established just fine.  If the client system is not behind a firewall
Active FTP works great and they are able to download and list files on
the FTP Server.  However, some users sitting behind their own firewalls
are unable to establish the DATA connection with the FTP Server (the
Control connection to port 21 works fine).

Investigation:
I used tcpdump on both live interfaces on the firewall to monitor ftp
requests coming in from an external user.

Control connection to port 21
eth0 tcpdump:
22:47:05.602646 <external.user>.1345 > <virtual.int.for.ftpserver>.ftp:
S 302620519:302620519(0) win 16060 <mss 1460,sackOK,timestamp
1036286[|tcp]> (DF)
22:47:05.603241 <virtual.int.for.ftpserver>.ftp > <external.user>.1345:
S 558954151:558954151(0) ack 302620520 win 8760 <mss 1460> (DF)
22:47:05.721866 <external.user>.1345 > <virtual.int.for.ftpserver>.ftp:
. ack 1 win 16060 (DF)
22:47:05.722508 <virtual.int.for.ftpserver>.ftp > <external.user>.1345:
P 1:50(49) ack 1 win 8760 (DF)
22:47:05.847353 <external.user>.1345 > <virtual.int.for.ftpserver>.ftp:
. ack 50 win 16011 (DF) [tos 0x10]
22:47:07.419656 <external.user>.1345 > <virtual.int.for.ftpserver>.ftp:
P 1:11(10) ack 50 win 16060 (DF) [tos 0x10]

_______________________________________________
Masq maillist  -  [EMAIL PROTECTED]
Admin requests can be handled at http://www.indyramp.com/masq-list/ -- THIS INCLUDES 
UNSUBSCRIBING!
or email to [EMAIL PROTECTED]

PLEASE read the HOWTO and search the archives before posting.
You can start your search at http://www.indyramp.com/masq/
Please keep general linux/unix/pc/internet questions off the list.

Reply via email to