RE: [Security Firewall] Problem with port forwarding

Hi florin,
I want to access the ftp Server from the net, the following rules were
created to try access from the net, not for the LAN:
ACCEPT  wan     fw      tcp     ftp     -
ACCEPT  wan     fw      tcp     ftp-data        -
ACCEPT  wan     lan     tcp     ftp     -
ACCEPT  wan     lan     tcp     ftp-data    

The ftp server is in active mode, so I should be able to access the
server...but I don´t
I have been trying with other ports and services(ex:VNC), but it doesn´t
work:

DNAT    wan     lan:192.168.1.101       tcp     5900     -       all

Thanks again

-----Mensaje original-----
De: security-firewall-owner-4qZELD6FgxheH41UXmfQsti2O/[email protected]
[mailto:security-firewall-owner-4qZELD6FgxheH41UXmfQsti2O/[email protected]] En nombre de florin
Enviado el: miércoles, 15 de junio de 2005 9:26
Para: security-firewall-4qZELD6FgxheH41UXmfQsti2O/[email protected]
Asunto: Re: [Security Firewall] Problem with port forwarding

Hi there,

I'm not sure I understand what you're trying to do:

You can actually access your ftp server inside your lan. That means
your ftp server is up and running.
You don't need any iptables rule for that because the ftp client are
on the same lan so they use the gateway or the firewall so all the
following rules are useless:
ACCEPT  wan     fw      tcp     ftp     -
ACCEPT  wan     fw      tcp     ftp-data        -
ACCEPT  wan     lan     tcp     ftp     -
ACCEPT  wan     lan     tcp     ftp-data       

You want to access your ftp server inside the lan from the net.
Your ftp server IP address is 192.168.1.101 AND your ftp server is
setup in active mode.

In that case the following rules are enough:

DNAT    wan     lan:192.168.1.101       tcp     ftp     -       all
DNAT    wan     lan:192.168.1.101       tcp     ftp-data        -       all

Please note that the above applies to an ftp server setup in active mode.

For passive mode you need to replace the last line with 
DNAT    wan     lan:192.168.1.101       tcp     1024:65535     -       all


On 6/14/05, ibon M. B. <[email protected]> wrote:
> thanks.
> yes, i´ve tried to connect from an external machine using the public ip,
and
> the sniffer does not detect any conecction on port 21 in the ftp server.
> 
> these are the rules i´ve created (i´ve tried any possible variation):
> ACCEPT  wan     fw      tcp     ftp     -
> ACCEPT  wan     fw      tcp     ftp-data        -
> DNAT    wan     lan:192.168.1.101       tcp     ftp     -       all
> DNAT    wan     lan:192.168.1.101       tcp     ftp-data        -
all
> 
> i´ve also tried:
> 
> ACCEPT  wan     lan     tcp     ftp     -
> ACCEPT  wan     lan     tcp     ftp-data        -
> DNAT    wan     lan:192.168.1.101       tcp     ftp     -       all
> DNAT    wan     lan:192.168.1.101       tcp     ftp-data        -
all
> 
> and:
> 
> ACCEPT  wan     fw      tcp     ftp     -
> ACCEPT  wan     fw      tcp     ftp-data        -
> ACCEPT  wan     lan     tcp     ftp     -
> ACCEPT  wan     lan     tcp     ftp-data        -
> DNAT    wan     lan:192.168.1.101       tcp     ftp     -       all
> DNAT    wan     lan:192.168.1.101       tcp     ftp-data        -
all
> 
> 
> 
> >From: Neill Mitchell <[email protected]>
> >Reply-To: security-firewall-4qZELD6FgxheH41UXmfQsti2O/[email protected]
> >To: security-firewall-4qZELD6FgxheH41UXmfQsti2O/[email protected]
> >Subject: Re: [Security Firewall] Problem with port forwarding
> >Date: Tue, 14 Jun 2005 13:18:49 +0000
> >
> >One thing to try to eliminate certain things. Have you tried to connect
to
> >the
> >ftp machine from an external machine? I assume you have the NAT all
> >configured correctly for this machine (i.e. you are not trying to access
it
> >externally via its internal address)?
> >
> >Cheers
> >On Tuesday 14 Jun 2005 10:06, ibon M. B. wrote:
> > > Thanks for your help
> > > I have created a custom rule to forward the ftp traffic to a computer
in
> >my
> > > lan, but port forwarding doesn´t seem to work.
> > > Custom Rule:
> > > Result --DNAT
> > > Predefined Services--FTP
> > > Protocol--FTP
> > > Client:WAN
> > > Server:LAN 192.168.1.100
> > > Forwarding Address:all
> > >
> > > i can connect the ftp server inside the lan, but not outside.
> > > any ideas?
> > >
> > >
> > >
> > >
> > >
> > > _____________________________________________________________________
> > > This message has been checked for all known viruses by Minuco
delivered
> > > through the MessageLabs Virus Scanning Service. For further infomation
> > > visit http://www.minuco.com or alternatively mail [email protected]
> >
> >--
> >Best regards
> >Neill Mitchell
> >
> >Minuco Vigilize
> >31 Museum Street, London, WC1A 1LG
> >
> >T: +44 (0)20 7692 2649
> >F: +44 (0)20 7436 9955
> >
> >http://www.minuco.com <http://www.minuco.com/>
> >
> >You have received this e-mail from Minuco. It is intended to be read by
> >the addressee because it could contain confidential and privileged
> >information (including any attachments). If you are not the person or
> >organisation this e-mail was intended for please return it to the sender
> >and delete it from your computer(s). You must not copy, distribute,
> >disclose, or disseminate the contents of this e-mail or its attachments
> >to any third party unless authorised by Minuco.
> >
> >It is the responsibility of the recipient to ensure that the forwarding,
> >opening or use of the e-mail (and any attachments) will not adversely
> >affect their systems or data. Please carry out appropriate virus checks.
> >
> >All rights reserved. The intellectual property in this e-mail and any
> >attachments are vested solely in Minuco.
> >
> 
> 
> 
> 
> 
> ____________________________________________________
> Want to buy your Pack or Services from MandrakeSoft?
> Go to http://www.mandrakestore.com
> Join the Club : http://www.mandrakeclub.com
> ____________________________________________________
> 
> 
> 


-- 
Florin

____________________________________________________
Want to buy your Pack or Services from MandrakeSoft? 
Go to http://www.mandrakestore.com
Join the Club : http://www.mandrakeclub.com
____________________________________________________