RE: Passive and Active ftp mode

Yes, Marius

The client is in the corporate internal network and proxy server is in the
DMZ zone. In this case, I don't use NAT between ftp client and proxy server.
I guess from proxy server to ftp server connection may do NAT which on ftp
server side it shows proxy server IP address incoming, right, Marius?

What is netcat? I don't see it on my Solaris and HP-UX boxes. Is it snope on
Solaris or nettl on HP-UX? Does proxy server need to initiate connection to
ftp client also? My setup is that ftp client initiate connection to ftp
proxy server and ftp proxy server can't initiate connection to ftp client
which is blocked by firewall. I just made it worked followed your
suggestion. Thanks.

Ruiyuan Jiang
Liz Claiborne, Inc.


-----Original Message-----
From: Marius Tomaschewski [mailto:[email protected]]
Sent: Monday, August 12, 2002 11:53 AM
To: Ruiyuan Jiang
Cc: [email protected]
Subject: Re: [proxy-suite] Passive and Active ftp mode


On Mon, Aug 12, 2002 at 11:18:38AM -0400, Ruiyuan Jiang wrote:
> Thanks for your answer, Marius

Hi!

> I changed SockBindRand to "yes" in the proxy configuration file
> and officially register the box on the DNS server. But I got the
> same thing. I don't see any messages in the syslog, etc.
> I do see a message in proxy server log once "ls" command in ftp
> session connection timed out and got back to ftp> prompt:
> 
> ftp-child: TECH-ERR can't connect Cli-Data for 156.146.239.33

The proxy isn't able to connect (data transfer) back to the client.

> What else can I do? Thanks.

The clients are in your internal network, right?

Start i.e. netcat on one of your ftp client machines:

  netcat -v -t -l -p 50021

Try to connect the it from the proxy machine:

  netcat -v -t ftp-client01 50021


Type "hello" - you should see it on the other machine.

Only if this test has worked, the proxy is able to support
active ftp on the client side.

There souldn't be any NAT or Masquerading between the
proxy and the client.
It is possible to use NAT between proxy and server - you
may need to set TranslatedAddress propelly in some cases.

Kind regards,
 Marius Tomaschewski <[email protected]>
--
 SuSE Linux AG, Nürnberg - SuSE Labs, Product Developement
 PGP public key available:   http://www.suse.de/~mt/mt.pgp
 Fprint:  EA 1F 92 75 1A F9 82 07  A1 28 DE 7A 32 E8 97 18