?
Solved

NAT Issues - Windows 2000 FTP Server

Posted on 2004-04-20
9
Medium Priority
?
991 Views
Last Modified: 2008-03-06
We have a customer that has a Cisco 806 router and a public subnet (/29 block).  Our setup is using NAT with specific ports from specific IP's mapped to internal addresses.

The setup works fine for port 80, 25 etc... with the Windows 2000 servers handling email, web etc...

My problem arrises with FTP server.  The customer runs their FTP on non-standard ports.  Actually he assigns each customer their own port (can't change this at this time).  So customer ABC has port 1216 on IP x.x.x.x for example.

When I do a test connection I get this type of output:

[root@server log]# ftp
ftp> open hostname.com
ftp: connect: Connection refused
ftp> open hostname.com 1216
Connected to hostname.com (123.123.123.123).
220 host Microsoft FTP Service (Version 5.0).
Name (hostname.com:root): sparks
331 Password required for sparks.
Password:
230 User sparks logged in.
Remote system type is Windows_NT.
ftp> dir
227 Entering Passive Mode (10,100,1,147,12,186).
ftp: connect: Connection timed out

As you can see, it appears that the server behind the NAT is trying to send back to me on a private IP address verus coming back to me on the public IP I actually connected on?  We have NAT'ed FTP servers at a lot of other customer sites using standard 20/21 ports and don't have this issue at all?  Am I missing something on the mapping?. at the other sites we only map port 21 out, nothing else...

I have to get this resolved ASAP so hoping for quick assistance (hence why offering a lot of points)

Thanks for your time,

Paul
0
Comment
Question by:kpmas
  • 5
  • 4
9 Comments
 

Expert Comment

by:GR999
ID: 10891102
Have you statically mapped the ports on the router i.e. "ip nat inside source static tcp inside 1216 outside 21"? ( I assume so) I tried this out myself and came up with the same issue, but after debugging I saw I was blocking the servers source of port 20 (the data port) coming back to me. This could be your issue also.

GR
0
 

Expert Comment

by:GR999
ID: 10891172
I found this link it might help undertsand.

http://www.networknewz.com/2003a/0922.html

GR
0
 
LVL 2

Author Comment

by:kpmas
ID: 10891266
Thanks for the info...  we're on the right track but I'm still puzzled..:)

Yes, have statically mapped the ports and you can connect but then a DIR or LS times out... how did you do the port 20 entry?  I tried "natting" out the port 20 back to the box but with no luck...

I have noticed that 227 Entering Passive Mode (10,100,1,147,12,186) has the private IP address but if we get the customer to let us run port 21 (which we did as a test this morning) I see the real world IP address and things work fine....

Thanks,

Paul
0
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 

Expert Comment

by:GR999
ID: 10891575
Well what I noticed when I tried it, it timed out out also on 'dir' until I allowed port 20 from server to client (any port). Have you tried using other ftp clients also. Try to put one in PASSIVE mode to see if that works.

GR
0
 
LVL 2

Author Comment

by:kpmas
ID: 10891657
Hmm.. I'm trying to see what I can do to fix this on the Cisco side...

I'm not blocking any ports from the server to the world via the router... have tried other clients (was using a linux box) such as CuteFTP and with it (running passive) I can login and get directory lists but can't do transfers... just a bunch of port errors....

I believe the customer is going to setup a different FTP package now since quite honestly the IIS FTP service sucks..:)
0
 

Expert Comment

by:GR999
ID: 10891703
You should be good on your router side. However what about the clients? Firewalls? When you tested this were you on the same network as the server or were you outside of it?

GR
0
 
LVL 2

Author Comment

by:kpmas
ID: 10891884
Outside of it behind other firewalls normally... at our main office we are behind a PIX connecting out to this customer over DSL to their Cisco router that we supply.. behind the router is their servers via NAT...

One thing I'm researching is IIS FTP service and whether or not you can force it to talk passive mode only... it seems that it's still trying to run in an active mode all the time.. could be wrong..

Paul
0
 

Accepted Solution

by:
GR999 earned 1500 total points
ID: 10892002
Not familiar with PIX but you should look at any traffic being denied from the server side to you and check what ports are blocked. That seems to be the issue. I host an ftp server (Linux) that is natted and it works fine. I tested it externally and port 20 being blocked is what I came up with. Good luck!

GR
0
 
LVL 2

Author Comment

by:kpmas
ID: 10892043
Yes, we have a number of linux ftp servers in behind natted cisco routers with no issues which makes me think it's an IIS issue.  Customer is going to move to WarFTP I believe now which we've ran as well and no problems..

Thanks for taking the time to answer my questions and try to assist.

Paul
0

Featured Post

Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

New Server 172.16.200.2  was moved from behind Router R2 f0/1 to behind router R1 int f/01 and has now address 172.16.100.2. But we want users still to be able to connected to it by old IP. How to do it ? We can used destination NAT (DNAT).  In DNAT…
How to set-up an On Demand, IPSec, Site to SIte, VPN from a Draytek Vigor Router to a Cyberoam UTM Appliance. A concise guide to the settings required on both devices
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

862 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question