Re: [Proftpd-user] Relaxed AllowForeignAddress option
Matus UHLAR - fantomas <[email protected]>
| Newsgroups | gmane.network.proftpd.user |
|---|---|
| Message-ID | <[email protected]> |
On 15.04.17 02:59, Dmitry Katsubo wrote: >I have come across the problem when ProFTPd is configured to use given > address (say, 77.10.11.12) for masquerading to be able to serve external > users in passive mode, while rejecting users from internal network with > message: > > SECURITY VIOLATION: Passive connection from 77.10.11.12 rejected > >Actually, in my network setup local users are able to set packages to > external IP address, which are looped back by NAT. However ProFTPd > considers this a security violation for good reason. On the other side I > cannot apply the solution from [1] using e.g. <VirtualHost 10.0.0.5>, as > the server which is running ProFTPd is different from NAT/gateway and it > doesn't own the external address 77.10.11.12. So the only way out (except > forcing the clients to use active connection) is to use > > AllowForeignAddress on > >In this respect I would like to suggest to introduce an extra option value: > > AllowForeignAddress off # All unmatched connections are rejected this does already exist > AllowForeignAddress relaxed # Data connections from the same IP as control connection + from masqueraded IP are accepted can't your NAT device translate also data connections? It should be able to do so. > AllowForeignAddress strict # Only data connections from the same IP as control connection are accepted this is the same as "AllowForeignAddress off" -- Matus UHLAR - fantomas, [email protected] ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. WinError #98652: Operation completed successfully. ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot _______________________________________________ ProFTPD Users List <[email protected]> Unsubscribe problems? http://www.proftpd.org/list-unsub.html