I'm using an Astlinux box as my firewall/router. Works great... except
for one little thing I can't figure out.
FTP connections always seem to time out.
Apr 10 02:12:35 mail proftpd[7396]: mail.redfish-solutions.com
(193.255.135.1[193.255.135.1]) - ANON anonymous: Login successful.
Apr 10 02:12:35 mail proftpd[7396]: mail.redfish-solutions.com
(193.255.135.1[193.255.135.1]) - Preparing to chroot to directory '/home/ftp'
Apr 10 02:17:34 mail proftpd[7396]: mail.redfish-solutions.com
(193.255.135.1[193.255.135.1]) - Passive data transfer failed, possibly due to
network issues
Apr 10 02:17:34 mail proftpd[7396]: mail.redfish-solutions.com
(193.255.135.1[193.255.135.1]) - Check your PassivePorts and MasqueradeAddress
settings,
Apr 10 02:17:34 mail proftpd[7396]: mail.redfish-solutions.com
(193.255.135.1[193.255.135.1]) - and any router, NAT, and firewall rules in the
network path.
Apr 10 02:17:34 mail proftpd[7396]: mail.redfish-solutions.com
(193.255.135.1[193.255.135.1]) - FTP no transfer timeout, disconnected
Apr 10 02:17:34 mail proftpd[7396]: mail.redfish-solutions.com
(193.255.135.1[193.255.135.1]) - FTP session closed.
Apr 10 02:17:35 mail proftpd[7421]: mail.redfish-solutions.com
(193.255.135.1[193.255.135.1]) - ANON anonymous: Login successful.
Apr 10 02:17:35 mail proftpd[7421]: mail.redfish-solutions.com
(193.255.135.1[193.255.135.1]) - Preparing to chroot to directory '/home/ftp'
Apr 10 02:17:37 mail proftpd[7421]: mail.redfish-solutions.com
(193.255.135.1[193.255.135.1]) - FTP session closed.
When I was behind an Cisco IOS firewall it just worked.
Yes, I have port forwarding for ports 20 and 21.
And yes, Arno's firewall is loading the correct NAT helpers:
pbx kd # lsmod
Module Size Used by
sch_hfsc 17184 1
binfmt_misc 10440 1
act_police 5860 2
cls_u32 7684 1
sch_ingress 3168 1
xt_CLASSIFY 1600 30
xt_length 1696 3
nf_nat_sip 4160 0
nf_conntrack_sip 9236 1 nf_nat_sip
xt_tcpudp 2880 169
xt_MARK 2048 0
ipt_TTL 2048 1
ipt_TOS 1984 34
ipt_MASQUERADE 3648 3
nf_nat_ftp 3136 0
ipt_LOG 5728 44
ipt_REJECT 4128 0
iptable_nat 7076 1
nf_nat 17676 4 nf_nat_sip,ipt_MASQUERADE,nf_nat_ftp,iptable_nat
iptable_mangle 2528 1
iptable_filter 2688 1
xt_multiport 2816 0
xt_state 2208 13
xt_limit 2400 48
xt_conntrack 2496 0
nf_conntrack_ftp 9088 1 nf_nat_ftp
nf_conntrack_ipv4 16844 15 iptable_nat
nf_conntrack 57496 10
nf_nat_sip,nf_conntrack_sip,ipt_MASQUERADE,nf_nat_ftp,iptable_nat,nf_nat,xt_state,xt_conntrack,nf_conntrack_ftp,nf_conntrack_ipv4
nfnetlink 6328 3 nf_nat,nf_conntrack_ipv4,nf_conntrack
ip_tables 11400 3 iptable_nat,iptable_mangle,iptable_filter
x_tables 13988 15
xt_CLASSIFY,xt_length,xt_tcpudp,xt_MARK,ipt_TTL,ipt_TOS,ipt_MASQUERADE,ipt_LOG,ipt_REJECT,iptable_nat,xt_multiport,xt_state,xt_limit,xt_conntrack,ip_tables
pc87360 18288 0
hwmon_vid 2464 1 pc87360
hwmon 3060 1 pc87360
i2c_isa 4928 1 pc87360
i2c_core 20464 2 pc87360,i2c_isa
bridge 48216 0
llc 6996 1 bridge
8021q 18696 0
ztdummy 4520 0
rtc 12336 1 ztdummy
zaptel 192612 3 ztdummy
hdlc 6180 1 zaptel
ppp_generic 25428 1 zaptel
slhc 6112 1 ppp_generic
geode_rng 2144 0
geode_aes 5636 0
blkcipher 5344 1 geode_aes
via_rhine 22184 0
mii 5024 1 via_rhine
cs5535_gpio 4596 0
pbx kd #
pbx kd # iptables -vnL -x
Chain FORWARD (policy DROP 1 packets, 192 bytes)
pkts bytes target prot opt in out source
destination
...
0 0 ACCEPT tcp -- br0 !br0 0.0.0.0/0
192.168.1.3 tcp dpt:20
32 1800 ACCEPT tcp -- br0 !br0 0.0.0.0/0
192.168.1.3 tcp dpt:21
11053 620290 ACCEPT tcp -- br0 !br0 0.0.0.0/0
192.168.1.3 tcp dpt:25
775 37620 ACCEPT tcp -- br0 !br0 0.0.0.0/0
192.168.1.3 tcp dpt:80
12 676 ACCEPT tcp -- br0 !br0 0.0.0.0/0
192.168.1.3 tcp dpt:113
6 368 ACCEPT tcp -- br0 !br0 0.0.0.0/0
192.168.1.3 tcp dpt:143
0 0 ACCEPT tcp -- br0 !br0 0.0.0.0/0
192.168.1.3 tcp dpt:515
298 15556 ACCEPT tcp -- br0 !br0 0.0.0.0/0
192.168.1.3 tcp dpt:587
0 0 ACCEPT tcp -- br0 !br0 0.0.0.0/0
192.168.1.3 tcp dpt:631
519 28275 ACCEPT tcp -- br0 !br0 0.0.0.0/0
192.168.1.3 tcp dpt:993
...
So what am I missing?
I'm using proftpd (obviously). And I've configured the MasqueradeAddress
and PassivePorts (49152-65535).
It's probably something stupid, but I'm not seeing it.
Any ideas?
-Philip
-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
Don't miss this year's exciting event. There's still time to save $100.
Use priority code J8TL2D2.
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
_______________________________________________
Astlinux-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/astlinux-users
Donations to support AstLinux are graciously accepted via PayPal to [EMAIL
PROTECTED]
