Re: [conntrack_ftp] ftp _server_ behind dnat

Hi,

For the records I put my original mail in attachment.

Am Sa den 19. Feb 2011 um 18:42 schrieb Pascal Hambourg:
> >> IME, nf_conntrack_ftp and nf_nat_ftp handle both passive and active
> >> modes. Briefly looking at the code, I can see mentions of PASV (standard
> >> passive), EPSV (extended passive), PORT (standard port) and EPRT
> >> (extended port).
> > 
> > True, it looks after PORT, EPRT, and in the reply for 227 and 229. But
> > false (at I understand the code) it register only for active connections
> > (coming from port 21 or any port that is configured by option, but that
> > portlist is limited to 8 ports max).
> 
> Connections on port 21 are control connections. Port 21 is used neither
> for active nor passive data connections.

Hmm.. Yes. you are right. Nevertheless that port is only looked about as
src and not as dst. But on a server the dst is port 21.

> > As I read the code there seems no way to find a PORT command in outgoing
> > connections. But that has to be detected when DNAT is used.
> 
> What do you mean by "outgoing connections" ?

Well, a bit confusing, I admit.

> Besides, IIUC your problem seems to be with passive mode, but PORT is
> used only for active mode.

I will try it other way:

On a client system I have SNAT so on INPUT on the external interface I
see port 21. So everything work well.

On a server I have DNAT so on OUTPUT I see the (destination) port
21. But exactly that do not trigger the helper.

And exact that is what I find by tests. If I do an active connection the
client is sending PORT to the server and the connection works well. But
if I try to use passive the server sends the PORT command and the
conntrack helper do never recognize the traffic as ftp related.

> However I guess the netfilter developper mailing list at
> [email protected] is more appropriate to discuss about the
> code.

Thanks, I xpost to them.

Regards
   Klaus
-- 
Klaus Ethgen                            http://www.ethgen.ch/
pub  2048R/D1A4EDE5 2000-02-26 Klaus Ethgen <[email protected]>
Fingerprint: D7 67 71 C4 99 A6 D4 FE  EA 40 30 57 3C 88 26 2B

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQEVAwUBTWAaDJ+OKpjRpO3lAQpoqgf/S2RgJvbKxfnm22ldaLPvjK6cfT8yr1gY
sgqPUIG8OLdfjJ0dnEkZS35fx9szEfzOkgUucMYLyxZ1uiV30k08kxmdlCjCDmlY
diNkaI24bMbCX5RjBOCaniWiDNMhIxprB8Ozg2HFaTVwOKNBYjBbb20EuqVTGnyT
x7FXtr4QDqa2SQ80+lnXLe8XCD06iTEdFdB/w76ea7ASlKJ4B/yKr28cdSrhm6nF
LIgPjeke9bW2/NZskLKlpMVvBphM4h4942fikcyOaeJhD1AGfQyHnKBy0qopE8Y7
X3dhg+Xa/oEfvITGhfYascxTiQGccvA9v/cCslTeszVDSDd8uHhWPg==
=0T4m
-----END PGP SIGNATURE-----