Shorewall users - Oct 2002 - 2 ftp servers

hey, 
 basically what i have right now is a suse linux machine as a  router using
shorewall 1.3.9b... eth0 is the wan (24.42.114.37) and eth1  is the local
network (192.168.0.1 to 192.168.0.7) ...

what i am now trying to do is place a ftp on the linux server (on port21) and
another ftp on 192.168.0.2 (port 90)

right now my rules look like 
ACCEPT net fw tcp ftp
DNAT net loc:192.168.0.2 tcp 99

the linux ftp server (on port 21) is working fine. but the ftp on 192.168.0.2
does not work...

any ideas?

Derek Knapp wrote:
>  
> hey,
>  basically what i have right now is a suse linux machine as a  router 
> using shorewall 1.3.9b... eth0 is the wan (24.42.114.37) and eth1  is 
> the local network (192.168.0.1 to 192.168.0.7) ...
>  
> what i am now trying to do is place a ftp on the linux server (on 
> port21) and another ftp on 192.168.0.2 (port 90)
>  
> right now my rules look like
> ACCEPT net fw tcp ftp
> DNAT net loc:192.168.0.2 tcp 99
So is the port number 90 as you say above or is in 99 as you have in your 
rule?
>  
> the linux ftp server (on port 21) is working fine. but the ftp on 
> 192.168.0.2 does not work...
>  
So I''m guessing that "a suse linux machine" and "the
linux server" are the
same system (your gateway/firewall) and that 192.168.0.2 is a different 
system, correct?

You need to follow the instructions at http://www.shorewall.net/ports.htm 
regarding running an FTP server on a nonstandard port. Once you have done 
that, your existing rules should work (once you decide which port number 
you are really using).

-Tom
-- 
Tom Eastep    \ Shorewall - iptables made easy
AIM: tmeastep  \ http://www.shorewall.net
ICQ: #60745924  \ teastep@shorewall.net

Tom Eastep wrote:
> 
> You need to follow the instructions at 
> http://www.shorewall.net/ports.htm regarding running an FTP server on a 
> nonstandard port. Once you have done that, your existing rules should 
> work (once you decide which port number you are really using).
> 
Once you have made the changes to /etc/shorewall/modules and/or 
/etc/modules.conf, you will need to unload the ip_conntrack_ftp and 
ip_nat_ftp modules before you "shorewall restart" (rebooting the
firewall
will also work of course).

-Tom
-- 
Tom Eastep    \ Shorewall - iptables made easy
AIM: tmeastep  \ http://www.shorewall.net
ICQ: #60745924  \ teastep@shorewall.net