Subject: ftp-gw starts an endless loop

From: "jean duerinckx" <[email-masked]>
Date: Sun, 13 Feb 2000 20:41:15 +0000

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hello,

I need some advice on the configuration of the ftp-gw software :
every time I try to access an external system trough the ftp-gw module
it gets in  an endless loop, I do not see where I made the error in
the configuration.

configuration is as follows :
OS : slackware linux 2.2.6
192.168.80.13 client on internal network
192.168.80.220 firewall connection on internal network

192.168.201.220 firewall connection to external network
192.168.201.99 ftp server on external network

I first connect to the firewall  :

ftp> open 192.168.80.220
Connected to 192.168.80.220.
220-ftp-gw : welcome
220
User (192.168.80.220:(none)): [email-masked]

now the client does not get any further response .

the system log on the firewall contains following messages:

Feb 13 20:21:41 bastion1 netacl[1851]: 
permit host=bison.mynet/192.168.80.13 service=ftp-gw 
execute=/usr/local/etc/ftp-gw
 Feb 13 20:21:41 bastion1 netacl[1851]:
permit host=bison.mynet/192.168.80.13 service=ftp-gw
execute=/usr/local/etc/ftp-gw
 Feb 13 20:21:41 bastion1 ftp-gw[1851]:
permit host=bison.mynet/192.168.80.13 use of gateway
 Feb 13 20:21:41
bastion1 ftp-gw[1851]: permit host=bison.mynet/192.168.80.13 use of
gateway
 Feb 13 20:21:58 bastion1 ftp-gw[1851]: permit
host=bison.mynet/192.168.80.13 connect to (null)
 Feb 13 20:21:58 bastion1 ftp-gw[1851]: permit 
host=bison.mynet/192.168.80.13 connect to (null)
 Feb 13 20:21:58 
bastion1 netacl[1852]: permit host=bastion0.mynet/192.168.80. 220 
service=ftp-gw execute=/usr/local/etc/ftp-gw
 Feb 13 20:21:58 bastion1 netacl[1852]: permit 
host=bastion0.mynet/192.168.80. 220 service=ftp-gw 
execute=/usr/local/etc/ftp-gw
 Feb 13 20:21:58 bastion1 ftp-gw[1852]: 
permit host=bastion0.mynet/192.168.80. 220 use of gateway

 .. snip ...

Feb 13 20:22:00 bastion1 inetd[71]: ftp/tcp server failing (looping),
service te rminated
 Feb 13 20:22:00 bastion1 inetd[71]: ftp/tcp server
failing (looping), service te rminated

my inetd.conf has following entry :

ftp     stream  tcp     nowait  root    /usr/local/etc/netacl ftp-gw

the netperm-table entries are :

#
# ftp netacl gateway rules:
# ------------------------
netacl-ftp-gw:  denial-msg      /usr/local/etc/ftp-deny.txt
netacl-ftp-gw:  welcome-msg     /usr/local/etc/ftp-welcome.txt
netacl-ftp-gw:  help-msg        /usr/local/etc/ftp-help.txt
netacl-ftp-gw:  timeout 3600
netacl-ftp-gw:  permit-hosts jean.mynet -exec /usr/local/etc/ftp-gw
netacl-ftp-gw:  permit-hosts 192.168.80.* -exec /usr/local/etc/ftp-gw

#
# ftp-gw gateway rules:
# ---------------------
ftp-gw:         deny-hosts unknown
ftp-gw:         permit-hosts 192.168.80.*
ftp-gw:         denial-msg      /usr/local/etc/ftp-deny.txt
ftp-gw:         welcome-msg     /usr/local/etc/ftp-welcome.txt
ftp-gw:         help-msg        /usr/local/etc/ftp-help.txt
ftp-gw:         timeout 3600

now where did I make the mistake(s)?

any suggestions ?

thanks in advance

Jean

---

From: Rick Murphy <[email-masked]>
Date: Sun, 13 Feb 2000 16:41:11 -0500

>it gets in  an endless loop, I do not see where I made the error in

Are you running the Linux firewall software - specifically the FTP 
masquerading module? It looks like your connection from the firewall to the 
external FTP server is being redirected back to the firewall for some reason.
         -Rick