Re: [Proftpd-user] Relaxed AllowForeignAddress option
Dmitry Katsubo <[email protected]>
| Newsgroups | gmane.network.proftpd.user |
|---|---|
| Message-ID | <[email protected]> |
>> AllowForeignAddress relaxed # Data connections from the same IP as control connection + from masqueraded IP are accepted > > can't your NAT device translate also data connections? > It should be able to do so. Thanks for the reply. I am not sure how it could be implemented. In two words, Internet gateway (= NAT) will use its own internal address, which will not match the client's anyway. Example: * Client with IP address 10.0.0.5 sends request to 77.10.11.12:21. Default route is via NAT with IP address 10.0.0.1. * NAT translates the destination address to FTP server (10.0.0.100) however it will also translate the source address, so FTP server will see that the request comes from 10.0.0.1 (instead of 10.0.0.5) and will trigger the mismatch. Similar explanation: https://www.frozentux.net/iptables-tutorial/chunkyhtml/x4033.html >> AllowForeignAddress strict # Only data connections from the same IP as control connection are accepted > > this is the same as "AllowForeignAddress off" Two of three options are repeating the existing functionality. "off" could be an alias to "strict". Another alternative is to introduce the list of "whiltelist" IP addresses – this could be helpful when indeed one FTP server sends the data to another FTP server while being orchestrated by some client. For example: AllowForeignAddress 10.0.0.1,10.0.0.2,192.168.1.0/24 -- With best regards, Dmitry ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot _______________________________________________ ProFTPD Users List <[email protected]> Unsubscribe problems? http://www.proftpd.org/list-unsub.html