Solved

NAT Issues - Windows 2000 FTP Server

Posted on 2004-04-20
9
972 Views
Last Modified: 2008-03-06
We have a customer that has a Cisco 806 router and a public subnet (/29 block).  Our setup is using NAT with specific ports from specific IP's mapped to internal addresses.

The setup works fine for port 80, 25 etc... with the Windows 2000 servers handling email, web etc...

My problem arrises with FTP server.  The customer runs their FTP on non-standard ports.  Actually he assigns each customer their own port (can't change this at this time).  So customer ABC has port 1216 on IP x.x.x.x for example.

When I do a test connection I get this type of output:

[root@server log]# ftp
ftp> open hostname.com
ftp: connect: Connection refused
ftp> open hostname.com 1216
Connected to hostname.com (123.123.123.123).
220 host Microsoft FTP Service (Version 5.0).
Name (hostname.com:root): sparks
331 Password required for sparks.
Password:
230 User sparks logged in.
Remote system type is Windows_NT.
ftp> dir
227 Entering Passive Mode (10,100,1,147,12,186).
ftp: connect: Connection timed out

As you can see, it appears that the server behind the NAT is trying to send back to me on a private IP address verus coming back to me on the public IP I actually connected on?  We have NAT'ed FTP servers at a lot of other customer sites using standard 20/21 ports and don't have this issue at all?  Am I missing something on the mapping?. at the other sites we only map port 21 out, nothing else...

I have to get this resolved ASAP so hoping for quick assistance (hence why offering a lot of points)

Thanks for your time,

Paul
0
Comment
Question by:kpmas
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 4
9 Comments
 

Expert Comment

by:GR999
ID: 10891102
Have you statically mapped the ports on the router i.e. "ip nat inside source static tcp inside 1216 outside 21"? ( I assume so) I tried this out myself and came up with the same issue, but after debugging I saw I was blocking the servers source of port 20 (the data port) coming back to me. This could be your issue also.

GR
0
 

Expert Comment

by:GR999
ID: 10891172
I found this link it might help undertsand.

http://www.networknewz.com/2003a/0922.html

GR
0
 
LVL 2

Author Comment

by:kpmas
ID: 10891266
Thanks for the info...  we're on the right track but I'm still puzzled..:)

Yes, have statically mapped the ports and you can connect but then a DIR or LS times out... how did you do the port 20 entry?  I tried "natting" out the port 20 back to the box but with no luck...

I have noticed that 227 Entering Passive Mode (10,100,1,147,12,186) has the private IP address but if we get the customer to let us run port 21 (which we did as a test this morning) I see the real world IP address and things work fine....

Thanks,

Paul
0
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 

Expert Comment

by:GR999
ID: 10891575
Well what I noticed when I tried it, it timed out out also on 'dir' until I allowed port 20 from server to client (any port). Have you tried using other ftp clients also. Try to put one in PASSIVE mode to see if that works.

GR
0
 
LVL 2

Author Comment

by:kpmas
ID: 10891657
Hmm.. I'm trying to see what I can do to fix this on the Cisco side...

I'm not blocking any ports from the server to the world via the router... have tried other clients (was using a linux box) such as CuteFTP and with it (running passive) I can login and get directory lists but can't do transfers... just a bunch of port errors....

I believe the customer is going to setup a different FTP package now since quite honestly the IIS FTP service sucks..:)
0
 

Expert Comment

by:GR999
ID: 10891703
You should be good on your router side. However what about the clients? Firewalls? When you tested this were you on the same network as the server or were you outside of it?

GR
0
 
LVL 2

Author Comment

by:kpmas
ID: 10891884
Outside of it behind other firewalls normally... at our main office we are behind a PIX connecting out to this customer over DSL to their Cisco router that we supply.. behind the router is their servers via NAT...

One thing I'm researching is IIS FTP service and whether or not you can force it to talk passive mode only... it seems that it's still trying to run in an active mode all the time.. could be wrong..

Paul
0
 

Accepted Solution

by:
GR999 earned 500 total points
ID: 10892002
Not familiar with PIX but you should look at any traffic being denied from the server side to you and check what ports are blocked. That seems to be the issue. I host an ftp server (Linux) that is natted and it works fine. I tested it externally and port 20 being blocked is what I came up with. Good luck!

GR
0
 
LVL 2

Author Comment

by:kpmas
ID: 10892043
Yes, we have a number of linux ftp servers in behind natted cisco routers with no issues which makes me think it's an IIS issue.  Customer is going to move to WarFTP I believe now which we've ran as well and no problems..

Thanks for taking the time to answer my questions and try to assist.

Paul
0

Featured Post

On Demand Webinar: Networking for the Cloud Era

Did you know SD-WANs can improve network connectivity? Check out this webinar to learn how an SD-WAN simplified, one-click tool can help you migrate and manage data in the cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Hello , This is a short article on how would you go about enabling traceoptions on a Juniper router . Traceoptions are similar to Cisco debug commands but these traceoptions are implemented in Juniper networks router . The following demonstr…
There are two basic ways to configure a static route for Cisco IOS devices. I've written this article to highlight a case study comparing the configuration of a static route using the next-hop IP and the configuration of a static route using an outg…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Suggested Courses
Course of the Month11 days, 8 hours left to enroll

623 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question