/* HINT: Search archives @ http://www.indyramp.com/masq/ before posting! */ > hello, > i have a strange problem which i did not found in the faqs or in the > archive. > > a linux box running 2.2.10-5 (originally a suse 6.2 distribution) does > masquerading for an internal net 192.168.0.x. the linux box has a > fixed ip and the other side is attached to a cisco router. > > users can use ftp on some sites, others don't work. it seems that the > data-stream does not work on these sites, since a get or a ls does not > get anything. > > modprobe ip_masq_ftp is of course included in the ipchains script. > > can anyone give me any recommondations (maybe source of the newest > ip_masq_ftp ?) or any hints how i can find the problem? > > any hints are greatly appreciated > jan I encountered the same problem when I did set up a large firewall which uses NAT for security and portfw's FTP-traffic. the problem appears to be the following: if you ftp to sites via masquerading which don't do a NAT (which are servers with offical IP's hanging right in the official numberspace), it functions just fine. the ip_masq_ftp-module gets the packets back without any serious problems. if you FTP to a site which does a NAT too and portfw's the packets for FTP via the gateway (with the offical IP) to an internal masquerading-host, the result gets messed up and your masq-module isn't clever enough to reassemble the packages. on this type of setup, additional packets with information for FTP are sent out by the remote NAT-network in port-ranges of 61000 and higher. I don't think the masq-module is clever enough to reassemble them. Well... I didn't try to configure it more precisely. There's a better way to solve this. You can avoid such problems. Most FTP-Progs like WSFTP or CuteFTP have the ability to use FTP-proxies. If you use a non-NAT-setup (or at least.... make the FTP-traffic believe you do not), it solves the problem. Put a program like JFTPGW on the router (-> freshmeat.net). it's an FTP-proxy... very easy to setup. then put the connection-parameters of CuteFTP or WSFTP to use the FTP-proxy (typically among firewall-settings) and you will recognize that you ain't got any problems anymore. :) Sincerly, Marcus mailto: [EMAIL PROTECTED] ICQ: 57830465 PGP Public-Key on request _______________________________________________ Masq maillist - [EMAIL PROTECTED] Admin requests can be handled at http://www.indyramp.com/masq-list/ -- THIS INCLUDES UNSUBSCRIBING! or email to [EMAIL PROTECTED] PLEASE read the HOWTO and search the archives before posting. You can start your search at http://www.indyramp.com/masq/ Please keep general linux/unix/pc/internet questions off the list.
