Re: RHAS piranha version? FTP support?

John Fauerbach wrote:
> We are still running the piranha that came with RH 6.2.
<snip>
> When a user ftp through the high availability server to one of the ftp 
> servers
> using active ftp, he connects with no problems.  But when he issuses a 
> command,
> the users remote firewall rejects the request because it comes from the 
> high
> availability servers's ip address and not the virtual servers's address.

Are you using LVS-masquerade, direct routing, or tunneling?  I'm 
guessing that you are using masqerade b/c direct routing and tunnelling 
should not suffer this problem.

The solution to this problem is not so much a newer piranha, but a newer 
kernel with iptables support.

And, *yes*, this problem can be solved with Red Hat Advanced Server. 
(Or even RH7.3 + latest piranha).

OTOH, depending on the user's firewall, the problem may be unworkable. 
If the firewall does not allow incoming connections to the user's 
machine, then no server side solution will help.

And what are IE and/or Netscape doing using active ftp anyway?  Active 
rarely works through a client-side firewall and almost never through a 
client-side masquerade.

> I have already try using NAT on my firewall to correct the problem but 
> it still happens in either IE or netscape (can't remember which)

The problem with 6.2 NAT is that you can't specify the address, then 
kernel picks it.  Apparently the kernel is not picking the VIP, but 
rather some other address, probably the firewalls primary external one.

With iptables you can specify the new address (and port if you wish). 
So you could make a rule like the following *on your LVS router*

iptables -t nat -A POSTROUTING -i $PRIVATE_IFACE \
   -p tcp --sport 20 -j SNAT --to-source $VIP

You may wish to juggle the package selection a bit (perhaps selecting by 
specific addresses), but the basic idea is to SNAT only the outgoing 
ftp-data packets, forcing the source address to be the right VIP.