Re: Passive FTP problem with a change of IP address
Frédéric Massot <[email protected]> Mon, 18 Nov 2013 14:50:54 +0100
| Newsgroups | gmane.linux.debian.devel.firewall |
|---|---|
| Organization | JULIANA Multimédia |
| Message-ID | <[email protected]> |
Le 16/11/2013 13:50, Pascal Hambourg a écrit : > Hello, > > Frédéric Massot a écrit : >> Hi, >> >> I have a firewall with iptables rules (kernel 3.10), until now I have >> always been able to connect to FTP server in passive or active mode. >> >> Here are the rules I use: >> >> iptables -A FORWARD -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT >> >> iptables -A FORWARD -p tcp -i $INTERNAL_INTERFACE -o $EXTERNAL_INTERFACE >> -s $INTERNAL_LAN --sport $UNPRIVPORTS --dport 21 -m state --state NEW -j >> ACCEPT >> >> >> I have a problem with the FTP server of one hoster. I connect well, but >> the data do not go into passive mode. >> >> I looked at the packets that pass through the firewall with iptraf and I >> noticed that the ftp-data connection that was on a different IP address. >> >> Connect to the FTP server (yy.yy.10.2) : >> 192.168.11.66:59577 --> yy.yy.10.2:21 >> >> ftp-data transmission on another IP address (yy.yy.10.10) : >> 192.168.11.66:32777 --> yy.yy.10.10:30527 >> >> ftp-data transmission on the other IP address is blocked by my firewall, >> it is not considered as RELATED. > > By default the FTP connection tracking module nf_conntrack_ftp checks > that the advertised address matches the source address. You may try to > add the option loose=1 when loading the module. > Or you could set your FTP client to use extended passive mode (EPSV), > which does not advertise a passive address. Thank you for the help. The "loose = 1" option works well, I am able to connect and list files. I have not found EPSV setting in filezilla or in the ftp command line (netkit-ftp). -- ============================================== | FRÉDÉRIC MASSOT | | http://www.juliana-multimedia.com | | mailto:[email protected] | | +33.(0)2.97.54.77.94 +33.(0)6.67.19.95.69 | ===========================Debian=GNU/Linux=== -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected] Archive: http://lists.debian.org/[email protected]