Subject: FTP Behind Masquerade?

From: "Jonathan Marchand" <[email-masked]>
Date: Fri, 1 Sep 2000 15:20:23 -0400

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hi there,

I just setup a linux box with masquerading enabled. Behind it, there's a
win2k machine. It runs an ftp server. I did a redirection for port 21 on the
linux to that internal host. But, I only get ftp to work in passive mode. It
won't work in active/normal mode. Why is that? How can I fix it? Is it
possible?

I inserted the ip_masq_ftp.o module on the linux, but it just says "unused"
when I do a lsmod, I'm not sure if it ip_masq_ftp is supposed to help in any
way for what I want to do. When I try to ftp (from the outside) to my ftp
behind the masquerade, I just get:

500 Invalid PORT Command.
ftp: bind: Address already in use

But if I set my client in passive mode, it work fine. So, is there anything
I could do to make it work in normal mode?

Regards,

Jonathan.

---

From: Joseph S D Yao <[email-masked]>
Date: Fri, 8 Sep 2000 17:16:22 -0400

On Fri, Sep 01, 2000 at 03:20:23PM -0400, Jonathan Marchand wrote:
...
> I could do to make it work in normal mode?

FTP is a full-duplex protocol, with each direction over a separate
channel.  The client initiates a connection to the server, but then the
server initiates a second connection back to the client.  With some
forms of masquerading, the second connection cannot be made.  So, you
can't do active FTP.  Passive works fine, since it's a half-duplex
protocol over a single channel.

-- 
Joe Yao				[email-masked] - Joseph S. D. Yao
COSPO/OSIS Computer Support					EMT-B
-----------------------------------------------------------------------
This message is not an official statement of COSPO policies.

---

From: Joseph S D Yao <[email-masked]>
Date: Fri, 8 Sep 2000 17:16:22 -0400

---

From: Michel Bardiaux <[email-masked]>
Date: Mon, 11 Sep 2000 15:12:00 +0200

> protocol over a single channel.

Sorry, but this is not correct. FTP uses a command channel, which is
bi-directional, and a data channel is opened in the appropriate
direction for each transfer. This is true whether the server is in
active or passive mode. In passive mode, the server prepares to receive
the data connection, but it is the client that connects to it, and there
are still 2 channels, one full-duplex and one half-duplex. Hence, even
passive mode requires masquerading support.

Anyway, maybe the ftp masquerading module only supports passive, or
maybe it supports active only for outgoing requests. If the doc (maybe
the Linux firewall HOWTO?) does not say, the OP should have a look at
the source.

Greetings.
-- 
Michel Bardiaux
Peaktime Belgium S.A.  Rue Margot, 37  B-1457 Nil St Vincent
Tel : +32 10 65.44.15  Fax : +32 10 65.44.10