Hi, I've got my Bering firewall box up and running (P133, 32 MB RAM) and it is masquerading my www and passive ftp connections fine. However, when I try to use active ftp, I think somehow I'm not letting the data connection back in. This is what's happening (let me know if I've forgot to include something):
Network setup: Other computers | Me | Firewall --------------- ----- ------------------------------- I | 192.168.1.100 |-----| HUB |-----| 192.168.1.254 | | 24.81.30.29 |--> S --------------- ----- ------------------------------- P eth0 | eth1 eth0 | (dynamic IP) Some more computers lsmod: Module Pages Used by ip_nat_irc 2384 0 (unused) ip_nat_ftp 2960 0 (unused) ip_conntrack_irc 3056 1 ip_conntrack_ftp 3824 2 smc-ultra 4268 1 ne 5988 1 8390 5780 0 [smc-ultra ne] FTP session: [mascdman@omega mascdman]$ lftp oksun2.okanagan.bc.ca lftp oksun2.okanagan.bc.ca:~> debug 9 lftp oksun2.okanagan.bc.ca:~> user aksilves Password: xxxxxxx lftp oksun2.okanagan.bc.ca:~> ls ---- Connecting to oksun2.okanagan.bc.ca (192.31.180.2) port 21 <--- 220 oksun2 FTP server (OUC/CIS on Sun Jun 23 23:09:58 PDT 2002) ready. ---> AUTH TLS <--- 500 'AUTH TLS': command not understood ---> USER aksilves <--- 331 Password required for aksilves. ---> PASS XXXX <--- 230 User aksilves logged in. ---> PWD <--- 257 "/home/oksun2/student/aksilves" is current directory ---> PASV <--- 227 Entering Passive Mode (192,31,180,2,224,166) ---- Connecting data socket to (192.31.180.2) port 57510 ---> LIST <--- 150 ASCII data connection for /bin/ls (24.81.30.29,1437) (0 bytes). <--- 226 ASCII Transfer complete. total 3280 <skipping directory listing> ---- Closing data socket lftp oksun2.okanagan.bc.ca:~> set ftp:passive-mode off lftp oksun2.okanagan.bc.ca:~> ls ---> PORT 192,168,1,100,5,122 <--- 200 PORT command successful. ---> LIST `ls' at 0 [Waiting for data connection...] And it will sit there... On some ftp sites, I'll eventually get: <--- 426 Connection closed; transfer aborted. On the firewall, this line is added to /proc/net/ip_conntrack, so I assume it's tracking the ftp connection? tcp 6 109 SYN_SENT src=192.31.180.2 dst=24.81.30.29 sport=20 dport=1402 [UNREPLIED] src=192.168.1.100 dst=192.31.180.2 sport=1402 dport=20 use=1 Iptables rule set: # Default policies iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP # Send inbound ident/auth to my oidentd server iptables -t nat -A PREROUTING -p tcp --syn --dport auth -j DNAT --to 192.168.1.100 # Masq stuff iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE # Allow loopback iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -i lo -j ACCEPT # Allow ssh to the firewall from the LAN iptables -A INPUT -i eth1 -p tcp --dport ssh -j ACCEPT # Allow DHCP traffic from the LAN iptables -A INPUT -i eth1 -p tcp --dport bootps -j ACCEPT iptables -A INPUT -i eth1 -p tcp --dport bootpc -j ACCEPT # Allow related & established traffic iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT # Allow related & established traffic iptables -A OUTPUT -m state -state RELATED,ESTABLISHED -j ACCEPT # Allow related & established traffic iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT # Allow new outbound connections iptables -A FORWARD -m state --state NEW -i eth1 -j ACCEPT # Allow inbound ident/auth traffic iptables -A FORWARD -i eth0 -p tcp --syn --dport auth -j ACCEPT What am I missing? Any inbound tcp connections for active ftp should be handled by the "-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT" rule, so I don't need to explicitly allow them, right? On a somewhat related note, a few of the servers I need to connect to are running on unusual ports (port 777, iirc). Somewhere, someone mentioned that ip_conntrack_ftp won't track these connections unless /etc/modules is changed from: ip_conntrack_ftp ip_nat_ftp to: ip_conntrack_ftp ports=21,777 ip_nat_ftp ports=21,777 Is this true and are these changes right? (Yes this change *has* been made to my /etc/modules and no, active ftp did not work *before* this change was made) Thanks in advance, Alan Silvester (mascdman _at_ shaw _dot_ ca) ------------------------------------------------------- Sponsored by: ThinkGeek at http://www.ThinkGeek.com/ ------------------------------------------------------------------------ leaf-user mailing list: [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/leaf-user SR FAQ: http://leaf-project.org/pub/doc/docmanager/docid_1891.html