Solved

NAT Issues - Windows 2000 FTP Server

Posted on 2004-04-20
9
934 Views
Last Modified: 2008-03-06
We have a customer that has a Cisco 806 router and a public subnet (/29 block).  Our setup is using NAT with specific ports from specific IP's mapped to internal addresses.

The setup works fine for port 80, 25 etc... with the Windows 2000 servers handling email, web etc...

My problem arrises with FTP server.  The customer runs their FTP on non-standard ports.  Actually he assigns each customer their own port (can't change this at this time).  So customer ABC has port 1216 on IP x.x.x.x for example.

When I do a test connection I get this type of output:

[root@server log]# ftp
ftp> open hostname.com
ftp: connect: Connection refused
ftp> open hostname.com 1216
Connected to hostname.com (123.123.123.123).
220 host Microsoft FTP Service (Version 5.0).
Name (hostname.com:root): sparks
331 Password required for sparks.
Password:
230 User sparks logged in.
Remote system type is Windows_NT.
ftp> dir
227 Entering Passive Mode (10,100,1,147,12,186).
ftp: connect: Connection timed out

As you can see, it appears that the server behind the NAT is trying to send back to me on a private IP address verus coming back to me on the public IP I actually connected on?  We have NAT'ed FTP servers at a lot of other customer sites using standard 20/21 ports and don't have this issue at all?  Am I missing something on the mapping?. at the other sites we only map port 21 out, nothing else...

I have to get this resolved ASAP so hoping for quick assistance (hence why offering a lot of points)

Thanks for your time,

Paul
0
Comment
Question by:kpmas
  • 5
  • 4
9 Comments
 

Expert Comment

by:GR999
Comment Utility
Have you statically mapped the ports on the router i.e. "ip nat inside source static tcp inside 1216 outside 21"? ( I assume so) I tried this out myself and came up with the same issue, but after debugging I saw I was blocking the servers source of port 20 (the data port) coming back to me. This could be your issue also.

GR
0
 

Expert Comment

by:GR999
Comment Utility
I found this link it might help undertsand.

http://www.networknewz.com/2003a/0922.html

GR
0
 
LVL 2

Author Comment

by:kpmas
Comment Utility
Thanks for the info...  we're on the right track but I'm still puzzled..:)

Yes, have statically mapped the ports and you can connect but then a DIR or LS times out... how did you do the port 20 entry?  I tried "natting" out the port 20 back to the box but with no luck...

I have noticed that 227 Entering Passive Mode (10,100,1,147,12,186) has the private IP address but if we get the customer to let us run port 21 (which we did as a test this morning) I see the real world IP address and things work fine....

Thanks,

Paul
0
 

Expert Comment

by:GR999
Comment Utility
Well what I noticed when I tried it, it timed out out also on 'dir' until I allowed port 20 from server to client (any port). Have you tried using other ftp clients also. Try to put one in PASSIVE mode to see if that works.

GR
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 
LVL 2

Author Comment

by:kpmas
Comment Utility
Hmm.. I'm trying to see what I can do to fix this on the Cisco side...

I'm not blocking any ports from the server to the world via the router... have tried other clients (was using a linux box) such as CuteFTP and with it (running passive) I can login and get directory lists but can't do transfers... just a bunch of port errors....

I believe the customer is going to setup a different FTP package now since quite honestly the IIS FTP service sucks..:)
0
 

Expert Comment

by:GR999
Comment Utility
You should be good on your router side. However what about the clients? Firewalls? When you tested this were you on the same network as the server or were you outside of it?

GR
0
 
LVL 2

Author Comment

by:kpmas
Comment Utility
Outside of it behind other firewalls normally... at our main office we are behind a PIX connecting out to this customer over DSL to their Cisco router that we supply.. behind the router is their servers via NAT...

One thing I'm researching is IIS FTP service and whether or not you can force it to talk passive mode only... it seems that it's still trying to run in an active mode all the time.. could be wrong..

Paul
0
 

Accepted Solution

by:
GR999 earned 500 total points
Comment Utility
Not familiar with PIX but you should look at any traffic being denied from the server side to you and check what ports are blocked. That seems to be the issue. I host an ftp server (Linux) that is natted and it works fine. I tested it externally and port 20 being blocked is what I came up with. Good luck!

GR
0
 
LVL 2

Author Comment

by:kpmas
Comment Utility
Yes, we have a number of linux ftp servers in behind natted cisco routers with no issues which makes me think it's an IIS issue.  Customer is going to move to WarFTP I believe now which we've ran as well and no problems..

Thanks for taking the time to answer my questions and try to assist.

Paul
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
PORT NUMBER FOR FIOS ROUTER 5 37
Enterasys QoS setup 2 33
WAN IP Conflict on Sonicwall 5 56
SMB Routers with GB WAN 12 31
New Server 172.16.200.2  was moved from behind Router R2 f0/1 to behind router R1 int f/01 and has now address 172.16.100.2. But we want users still to be able to connected to it by old IP. How to do it ? We can used destination NAT (DNAT).  In DNAT…
Tired of waiting for your show or movie to load?  Are buffering issues a constant problem with your internet connection?  Check this article out to see if these simple adjustments are the solution for you.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now