Allowing incoming FTP traffic

Internet connection is DSL

FTP server is 192.168.1.100 and is defined as such (255.255.255.255).

I have the 2 packet filter rules listed below:

1  PPTP-Pool Any Internal_Network__ Allow
2  Internal_Network__ Any Any Allow

And the following NAT rule (MASQ)

Archangel   Internal_Network__ -> All / All   MASQ__External   None

I am using version 3.383, and I haven't been using Astaro since version 2.  Can someone please tell me how to allow external FTP traffic to my internal FTP server.  I have tried several times, but I am missing or not getting something right.

Thanks

Parents

0 arch113 over 22 years ago

Please I just need example of what exactly I need to do to get ftp traffic. I am a little confused by the config of DNAT/SNAT and Packet Filter. [:S]
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 andreas over 22 years ago in reply to arch113

Hi,

using our great UBB "search"-function with the words "ftp server nat" provided me with many hits ... for example this thread:
FTP DNAT link.
To summarize: you need to map incoming traffic (dest: your ASL) to your internal FTP Server (internal IP) using DNAT.

Greets,
andreas
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 arch113 over 22 years ago in reply to andreas

I did do a search, and it didn't help. Astaro 3.383 for some reason looks different to me, what I am having a hard time is figuring out what to put for:

Packets to match:
Source address-Destination address-Service

Change source to:

Change destination to:

I have the FTP server already defind as FTP SERVER with a subnet mask of 255.255.255.255
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 arch113 over 22 years ago in reply to arch113

See if this is right:

Packets to match:
Source address=external network
Destination address=FTP SERVER (defined as 192.168.1.100)
Service=FTP

What I have no idea is what to put for the Change Source to: fileds...

Change source to:
Service:

Change destination to:
Service:
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 DV_Kaschke over 22 years ago in reply to arch113

May be I'm wrong, but this seems not to be an issue to discuss here - it's explained in the documentation!

Anyway - try this (tested with 3.216):

Ruletype: SNAT/DNAT
Source adress: ANY
Destination adress: your external interface
Service: FTP
Change destination to: your internal FTP-Server

You also need an paket-filter rule for this:

From: ANY
Service: FTP
To: your internal FTP-Server
Action: allow
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 DV_Kaschke over 22 years ago in reply to arch113

May be I'm wrong, but this seems not to be an issue to discuss here - it's explained in the documentation!

Anyway - try this (tested with 3.216):

Ruletype: SNAT/DNAT
Source adress: ANY
Destination adress: your external interface
Service: FTP
Change destination to: your internal FTP-Server

You also need an paket-filter rule for this:

From: ANY
Service: FTP
To: your internal FTP-Server
Action: allow
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

0 JimmyM over 22 years ago in reply to DV_Kaschke

DV has got it. That's EXACTLY how to do it. It doesn't get simpler than that.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Angelus over 22 years ago in reply to JimmyM

For comments ....

Be sure that your FTP server has a PASSIVE connexion configuration ... unless you will have many pbs ...

Bye
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 arch113 over 22 years ago in reply to Angelus

Thank you DV_Kaschke that was exactly what I was asking for.

Thank you for your help.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel