/* HINT: Search archives @ http://www.indyramp.com/masq/ before posting! */ This question has been asked before but with little in the way of a definitive answer. Any information is appreciated. Scenario: 10.x.x.x/27 192.168.x.x/24 Internet <-------------> Firewall <----------------> FTP Server ipchains ipmasqadm portfw Firewall interfaces: eth0 = firewall.domain = 10.x.x.1 eth0:0 = ftp.domain = 10.x.x.2 eth1 = internal interface = 192.168.x.1 I have setup an FTP Server on a private segment and am using ipmasqadm to portfw 10.x.x.x:21 to my internal FTP server. The control connection is established just fine. If the client system is not behind a firewall Active FTP works great and they are able to download and list files on the FTP Server. However, some users sitting behind their own firewalls are unable to establish the DATA connection with the FTP Server (the Control connection to port 21 works fine). Investigation: I used tcpdump on both live interfaces on the firewall to monitor ftp requests coming in from an external user. Control connection to port 21 eth0 tcpdump: 22:47:05.602646 <external.user>.1345 > <virtual.int.for.ftpserver>.ftp: S 302620519:302620519(0) win 16060 <mss 1460,sackOK,timestamp 1036286[|tcp]> (DF) 22:47:05.603241 <virtual.int.for.ftpserver>.ftp > <external.user>.1345: S 558954151:558954151(0) ack 302620520 win 8760 <mss 1460> (DF) 22:47:05.721866 <external.user>.1345 > <virtual.int.for.ftpserver>.ftp: . ack 1 win 16060 (DF) 22:47:05.722508 <virtual.int.for.ftpserver>.ftp > <external.user>.1345: P 1:50(49) ack 1 win 8760 (DF) 22:47:05.847353 <external.user>.1345 > <virtual.int.for.ftpserver>.ftp: . ack 50 win 16011 (DF) [tos 0x10] 22:47:07.419656 <external.user>.1345 > <virtual.int.for.ftpserver>.ftp: P 1:11(10) ack 50 win 16060 (DF) [tos 0x10] _______________________________________________ Masq maillist - [EMAIL PROTECTED] Admin requests can be handled at http://www.indyramp.com/masq-list/ -- THIS INCLUDES UNSUBSCRIBING! or email to [EMAIL PROTECTED] PLEASE read the HOWTO and search the archives before posting. You can start your search at http://www.indyramp.com/masq/ Please keep general linux/unix/pc/internet questions off the list.
