Re: [Proftpd-user] Relaxed AllowForeignAddress option

On 21.04.17 00:30, Dmitry Katsubo wrote:
>>>  AllowForeignAddress relaxed # Data connections from the same IP as control connection + from masqueraded IP are accepted
>>
>> can't your NAT device translate also data connections?
>> It should be able to do so.
>
>Thanks for the reply.
>
>I am not sure how it could be implemented. In two words, Internet gateway (= NAT) will use its own internal address, which will not match the client's anyway. Example:
>
>* Client with IP address 10.0.0.5 sends request to 77.10.11.12:21. Default route is via NAT with IP address 10.0.0.1.
>* NAT translates the destination address to FTP server (10.0.0.100) however it will also translate the source address, so FTP server will see that the request comes from 10.0.0.1 (instead of 10.0.0.5) and will trigger the mismatch.

the NAT gateway should translate all PASV/EPSV/PORT/EPRT commands, so the
connections will go through the NAT gateway.  Both client and server will
communicate with IP of the gateway (not with each other), so no mismatch
will happen.


if you are unable to fix the NAT gateway, it should be possiblt to work
around your problem by defining class for your internal network:
http://www.proftpd.org/docs/howto/Classes.html

and by allowing foreign address to your internal network by using
mod_ifsession and <IfClass> directive.

-- 
Matus UHLAR - fantomas, [email protected] ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Save the whales. Collect the whole set.

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html