Re: [Proftpd-user] Need help with MasqueradeAddress

That was it! Luckily the installed proftpd was built with dso support so I
didn't have to worry about re-compiling to include mod_ifsession. At first
I couldn't figure out why it wasn't working but I checked the logs and
realized that external connections were all logged as coming from a single
internal ip (likely firewall or load balancer). An easy change to just to
classify that single IP and now it works. Thanks a lot!

On Thu, Dec 16, 2021 at 8:03 PM TJ Saunders <[email protected]> wrote:

>
> > Regarding a config entry like this...
> > MasqueradeAddress ftp.domainname.com
> >
> > ...does the server respond to PASV with the domain name
> > (eg:ftp.domainname.com) and expect the client to resolve the name to an
> > IP or does the server resolve the name first and only pass back the IP
> > address?
>
> The latter -- the configured MasqueradeAddress name is resolved to an IP
> address, that IP address is sent to the client in the PASV response.  The
> protocol only allows for IP addresses (IPv4 or, for EPSV, IPV6 as well),
> not DNS names.
>
> > My server is on a private-address network but is also accessible from
> > the public internet (via a NAT I think). Internal and external clients
> > can reach the server with the same hostname (eg: ftp.domainname.com)
> > and external and internal dns will resolve the same name to the correct
> > external or internal ip accordingly. The problem is for external users,
> > the server is responding with the internal IP for PASV.
>
> Hmm.  I've not tried this configuration (I will try to do so soon), but an
> initial idea might be to use classes, and mod_ifsession.  That is, maybe
> something like this:
>
>   <Class internal>
>     From 127.0.0.1/32
>     From 192.168.0.0/16
>     From 172.16.0.0/12
>     From 10.0.0.0/8
>   </Class>
>
>   <VirtualHost ftp.domainname.com>
>
>     # Only provide the MasqueradeAddress to external clients
>     <IfClass !internal>
>       MasqueradeAddress public-ip-address
>     </IfClass
>
> > I thought about using <VirtualHost> entries with different
> > MasqueradeAddress entries for internal and external connections each,
> > but I don't think that would work as internal and external clients are
> > both using the same hostname to reach the server.
>
> This is the other approach, but does require that the external and
> internal clients connect to different IP addresses (or ports).
>
> Hope this helps,
> TJ
>
>
> _______________________________________________
> ProFTPD Users List   <[email protected]>
> Unsubscribe problems?
> http://www.proftpd.org/list-unsub.html
>

_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html