Re: [Proftpd-user] Relaxed AllowForeignAddress option
Dmitry Katsubo <[email protected]>
| Newsgroups | gmane.network.proftpd.user |
|---|---|
| Message-ID | <[email protected]> |
On 2017-04-21 17:54, Matus UHLAR - fantomas wrote: >> Thanks for the reply. >> >> I am not sure how it could be implemented. In two words, Internet gateway >> (= NAT) will use its own internal address, which will not match the >> client's anyway. Example: >> >> * Client with IP address 10.0.0.5 sends request to 77.10.11.12:21. Default >> route is via NAT with IP address 10.0.0.1. >> * NAT translates the destination address to FTP server (10.0.0.100) however >> it will also translate the source address, so FTP server will see that the >> request comes from 10.0.0.1 (instead of 10.0.0.5) and will trigger the >> mismatch. > > the NAT gateway should translate all PASV/EPSV/PORT/EPRT commands, so the > connections will go through the NAT gateway. Both client and server will > communicate with IP of the gateway (not with each other), so no mismatch > will happen. I understand the idea. It is possible on Linux [1], however my NAT does not support "active" modification of the e.g. PASV command. More over I am using secured FTP (FTPS), which naturally does not allow this kind of tricks. > if you are unable to fix the NAT gateway, it should be possible to work > around your problem by defining class for your internal network: > http://www.proftpd.org/docs/howto/Classes.html > > and by allowing foreign address to your internal network by using > mod_ifsession and <IfClass> directive. Thanks! That is the most elegant solution. Pity it is missing in [2] otherwise I would have explored it. I have applied below configuration and it seems to work fine from the first glance: MasqueradeAddress 77.10.11.12 <IfModule mod_ifsession.c> <Class internal> From 10.0.0.0/8 </Class> <IfClass internal> MasqueradeAddress 10.0.0.100 </IfClass> </IfModule> [1] http://www.shorewall.net/FTP.html#Conntrack [2] http://www.proftpd.org/docs/howto/NAT.html -- With best regards, Dmitry ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot _______________________________________________ ProFTPD Users List <[email protected]> Unsubscribe problems? http://www.proftpd.org/list-unsub.html