Link to home
Create AccountLog in
Avatar of stoutenstorm
stoutenstorm

asked on

How to route FTP via DMZ with iptables?

My Linux firewall has 3 interfaces eth0 to Internet, eth1 to local LAN (192.168.1.0/24) and eth2 to DMZ (192.168.2.0/24)
In the DMZ area I have a FTP server (192.168.2.253). The FTP server in the DMZ and the Linux Firewall (192.168.1.254) has iptables enabled.

FTP is working from the local network (192.168.1.0/24) to the FTP server in DMZ.
I added these lines to iptables on the firewall (192.168.1.254)

# Network 1 forwarded outgoing client request to network 2 (DMZ 1)
iptables -A FORWARD -i eth1 -p tcp -s 192.168.1.0/24 -d 192.168.2.0/24 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A FORWARD -o eth1 -p tcp -s 192.168.2.0/24 -d 192.168.1.0/24 -m state --state ESTABLISHED,RELATED -j ACCEPT

The FTP server in the DMZ is accepting all incoming requests, active and passive

But connection from the Internet fails just after a successful logon.

I addes these lines to iptables on the firewall (192.168.1.254)

# Network 1 FTP forwarded incoming client request
iptables -t nat -A PREROUTING -i eth0 -p tcp -s 0/0 --sport 1024:65535 -d 192.168.254.2 --dport 21 -j DNAT --to 192.168.2.253
iptables -A network2_in -p tcp -s 0/0 --sport 1024:65535 -d 192.168.2.253 --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A network2_out -p tcp -s 192.168.2.253 --sport 21 -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
iptables -A network2_in -p tcp -s 0/0 --sport 1024:65535 -d 192.168.2.253 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A network2_out -p tcp -s 192.168.2.253 --sport 1024:65535 -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT

This is what happened when connection to the FTP server in DMZ over the Internet:

H:\>ftp ftp.xxxxx.eu
Verbonden met ftp.xxxxx.eu.
220 Armada Linux FTP server ready
Gebruiker (ftp.xxxxx.eu:(none)): xxxxx
331 Please specify the password.
Wachtwoord:
230 Login successful.
ftp> ls
500 Illegal PORT command.
425 Use PORT or PASV first.
ftp> quote PASV
227 Entering Passive Mode (192,168,254,2,243,17)
ftp> ls
425 Failed to establish connection.
ftp>

The logon is successful but ftp-data exchange fails.

my vsftp.conf file:

# /etc/vsftpd.conf: OpenNA, Inc. (last updated 2007 Jan 09)
#
# LOCAL USERS FTP ACCESS CONFIGURATION BEGING HERE
# ------------------------------------------------
# Please, remove all configurations below, if you don't want to provide
# local users FTP access on your server.

anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=002
max_clients=100
max_per_ip=10
listen=YES
xferlog_enable=YES
connect_from_port_20=YES
one_process_model=NO
use_localtime=YES
nopriv_user=ftp
ftpd_banner=Armada Linux FTP server ready
chroot_local_user=YES
pasv_enable=YES
pasv_min_port=1024
pasv_max_port=65535
log_ftp_protocol=YES

Could you shine a light on this?

Bob
Avatar of Roachy1979
Roachy1979
Flag of United Kingdom of Great Britain and Northern Ireland image

You will need to add rules pertaining to port 20 (the FTP data port)

$iptables -t nat -A PREROUTING -i eth0 -p tcp -s 0/0 --sport 1024:65535 -d 192.168.254.2 --dport 20 -j DNAT --to 192.168.2.253

$iptables -A network2_in -p tcp -s 0/0 --sport 1024:65535 -d 192.168.2.253 --dport 20 -m state --state NEW,ESTABLISHED -j ACCEPT

Hope this helps!
Avatar of stoutenstorm
stoutenstorm

ASKER

NO, this makes no difference...
Can you post the output of your vsftp log file and the IPTables log?

You may also need to add the following:

modprobe ip_conntrack
modprobe ip_conntrack_ftp

Thes modules are already loaded:

lsmod | grep ftp
nf_nat_ftp              5376  0
nf_conntrack_ftp       11648  1 nf_nat_ftp
nf_nat                 19756  3 nf_nat_ftp,ipt_REDIRECT,iptable_nat
nf_conntrack           60424  6 nf_nat_ftp,nf_conntrack_ftp,xt_state,iptable_nat,nf_nat,nf_conntrack_ipv4

vsftp.log

Mon Mar  3 13:46:13 2008 [pid 2540] CONNECT: Client "84.xxx.xxx.128"
Mon Mar  3 13:46:13 2008 [pid 2540] FTP response: Client "84.xxx.xxx.128", "220 Armada Linux FTP server ready"
Mon Mar  3 13:46:15 2008 [pid 2540] FTP command: Client "84.xxx.xxx.128", "USER test"
Mon Mar  3 13:46:15 2008 [pid 2540] [test] FTP response: Client "84.xxx.xxx.128", "331 Please specify the password."
Mon Mar  3 13:46:20 2008 [pid 2540] [test] FTP command: Client "84.xxx.xxx.128", "PASS <password>"
Mon Mar  3 13:46:20 2008 [pid 2539] [test] OK LOGIN: Client "84.xxx.xxx.128"
Mon Mar  3 13:46:20 2008 [pid 2541] [test] FTP response: Client "84.xxx.xxx.128", "230 Login successful."
Mon Mar  3 13:47:45 2008 [pid 2541] [test] FTP command: Client "84.xxx.xxx.128", "PORT 192,168,99,21,9,229"
Mon Mar  3 13:47:45 2008 [pid 2541] [test] FTP response: Client "84.xxx.xxx.128", "500 Illegal PORT command."
Mon Mar  3 13:47:45 2008 [pid 2541] [test] FTP command: Client "84.xxx.xxx.128", "NLST"
Mon Mar  3 13:47:45 2008 [pid 2541] [test] FTP response: Client "84.xxx.xxx.128", "425 Use PORT or PASV first."
Mon Mar  3 13:47:50 2008 [pid 2541] [test] FTP command: Client "84.xxx.xxx.128", "PASV"
Mon Mar  3 13:47:50 2008 [pid 2541] [test] FTP response: Client "84.xxx.xxx.128", "227 Entering Passive Mode (192,168,2,253,146,254)"
Mon Mar  3 13:47:53 2008 [pid 2541] [test] FTP command: Client "84.xxx.xxx.128", "NLST"

I've no issue related iptables logging
ASKER CERTIFIED SOLUTION
Avatar of Arty K
Arty K
Flag of Kazakhstan image

Link to home
membership
Create an account to see this answer
Signing up is free. No credit card required.
Create Account
This make sense...

It´s true, I´ve a cisco router with the actual Internet address. This router maps all Internet trafic to the Linux firewall.

It´s not possible to use the external IP address on the Linux firewall.

Could you explain a little bit more about the solutions, which I can use?
-FTP compatible nat between your Linux and the Internet?

We would like to share some large documents with customers. Document directories are protected by username and password.

Is this still possible?
> -FTP compatible nat between your Linux and the Internet?

Cisco IOS can intercept PORT reply for NATed FTP connection. What cisco are you using and can you show us it's config?
I´m currently not at the client site, but it could be a Cisco or a Thompson Speedtouch 608i.

The router is managed by Belgacom (Belgium).

Later today I´ll submit the correct router type.
It's a Thompson Speedtouch 608i, I can't generate the config file for you.

All Internet trafic is routed to 192.168.254.2.

What should be configured to make passive FTP work?
> What should be configured to make passive FTP work?

You are out of luck. There is no way to publish FTP server behind dual NAT in your hardware configuration. Unless you will find a way how to modify PORT command reply. I don't know how to do it.
What about the other options...

Could you explain a little bit more?
I have very limited internet right now, I can read more about Tompson SpeedTouch at next monday.

Zero-cost option is to configure Tompson modem (if I guess correctly and it's just a DSL modem) in 'bridging' mode (if possible at all), then configure Linux to connect directly to ISP and to be the only router in your network, also it will have a real IP. But everything depends on your network topology...

I need more info about your network topology and about Tompson modem.
But you understand the root cause of the problem, the PORT command returning from the server to client is changed to correct value only on devices that supports FTP NATing (now your Linux  supports it, but Tompson seems not). It doesn't matter how many such devices (your server may be behind dual NAT), but _all_ of them should track FTP protocol correctly.



Thank you Nopius,, I´ll contact Belgacom directly on the FTP tracking issue.

I´ll keep you informed
Belgacom is not cooperative in providing a solution.

If I understand it correctly the Thompson router should be aware about the passive FTP packets and add/change the correct Internet IP address to it. This differs from normal active FTP, HTTP etc...  packets, which do work correctly.

Is it possible to make the Thompson router passive FTP aware?
> Belgacom is not cooperative in providing a solution.

Probably that's not their deal, that's a vendor problem.

> If I understand it correctly the Thompson router should be aware about the passive FTP packets and add/change the correct Internet IP address to it.

Yes. To be more precise, it should:
1) Analize TCP stream from server, and wait for PORT command with parameters (IP and port)
2) It should substitute the IP address in PORT reply to it's own external address, send this modified PORT to client and reserve port number for back reply from a client
3) When client connects to the given port for data channel, it should also tunnel connection to the real server

That's quite complex task for a single modem.


> Is it possible to make the Thompson router passive FTP aware?

Only router vendor can provide authoritative answer, but most likely - no.
Nopius thank for your excellent support on this matter.
The topic is clear to me.
This morning we decided to change to Telenet a cable solution. This will solve also this issue.
The reason for changing to cable has nothing to do with this issue, but with relayability.
stoutenstorm, hi.

I guess that's not a good deal to accept your last comment as a solution...

We found that the problem is in your router, not supporting FTP NAT and in your double NAT connection to the internet.
Nopius, I accept the reason why it's not working. The solution could be anything in replacing the Thompson, upgrading the Linux firewall to act as router... etc.
> The solution could be anything in replacing the Thompson, upgrading the Linux firewall to act as router...

Yes, that was a proposed solution:

"I see the only way to fix it is to use external IP address on firewall or to use FTP compatible nat between your Linux and the Internet. Other way is not to use FTP protocol (but SCP or SFTP) or to place HTTP proxy on your Linux firewall (that will proxy all ftp requests to your internal ftp server) and ask remote client to use FTP over HTTP proxy."

FTP compatible NAT you may find either on Linux or on Cisco, that was also mentioned.

Even changing the Internet connection completely to another topology and switching to another Internet provider fits into this schema, unless it will be FTP incompatible NAT device between your Linux and the Internet...
Force accepted.
modus_operandi
EE Moderator