Re: Net > DMZ > AllowFTP

Jerry Vonau
Fri, 03 Jun 2005 00:15:54 -0000

> Lables:
> Gateway = 209.5.171.65
> Netmask = 255.255.255.192
> Eth0 = net = 209.5.171.66
> Eth1 = loc = 192.168.0.1
> There is no NAT clients, in essence loc is dmz. I can rename loc to
dmz
> if that helps. Proxy/ARP is used for IP addresses 209.5.171.67-126
>
>
> Problem:
> Using the Shorewall Action AllowFTP does not result in desired
behavior
> when connecting from Internet to machines behind firewall in DMZ.
From
> my understanding, ip_conntrac should see a person come in on port
21,
> and automatically open either port 20 in regular ftp mode, or open
> highports in pasv mode. This does not happen, and using either
regular
> or pasv transfers fail. I had to manually open the ftp-data and the
high
> ports to allow my clients to ftp in.
>
> Shorewall version
> 2.2.4
>
> ip addr show
> 1: lo: <LOOPBACK,UP> mtu 16436 qdisc noqueue
>     link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
>     inet 127.0.0.1/8 brd 127.255.255.255 scope host lo
>     inet6 ::1/128 scope host
>        valid_lft forever preferred_lft forever
> 2: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen
1000
>     link/ether 00:a0:d2:1c:aa:13 brd ff:ff:ff:ff:ff:ff
>     inet 209.5.171.66/26 brd 209.5.171.127 scope global eth0
>     inet6 fe80::2a0:d2ff:fe1c:aa13/64 scope link
>        valid_lft forever preferred_lft forever
> 3: eth1: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen
1000
>     link/ether 00:a0:d2:1c:a9:7f brd ff:ff:ff:ff:ff:ff
>     inet 192.168.0.1/24 brd 192.168.0.255 scope global eth1
>     inet6 fe80::2a0:d2ff:fe1c:a97f/64 scope link
>        valid_lft forever preferred_lft forever
> 4: sit0: <NOARP> mtu 1480 qdisc noop
>     link/sit 0.0.0.0 brd 0.0.0.0
>
> ip route show
>
> 209.5.171.67 dev eth1  scope link
> 209.5.171.68 dev eth1  scope link
> 209.5.171.69 dev eth1  scope link
> 209.5.171.70 dev eth1  scope link
> 209.5.171.71 dev eth1  scope link
> 209.5.171.72 dev eth1  scope link
> 209.5.171.73 dev eth1  scope link
> 209.5.171.74 dev eth1  scope link
> 209.5.171.75 dev eth1  scope link
> 209.5.171.76 dev eth1  scope link
> 209.5.171.77 dev eth1  scope link
> 209.5.171.78 dev eth1  scope link
> 209.5.171.79 dev eth1  scope link
> 209.5.171.80 dev eth1  scope link
> 209.5.171.81 dev eth1  scope link
> 209.5.171.82 dev eth1  scope link
> 209.5.171.83 dev eth1  scope link
> 209.5.171.84 dev eth1  scope link
> 209.5.171.85 dev eth1  scope link
> 209.5.171.86 dev eth1  scope link
> 209.5.171.87 dev eth1  scope link
> 209.5.171.88 dev eth1  scope link
> 209.5.171.89 dev eth1  scope link
> 209.5.171.90 dev eth1  scope link
> 209.5.171.91 dev eth1  scope link
> 209.5.171.92 dev eth1  scope link
> 209.5.171.93 dev eth1  scope link
> 209.5.171.94 dev eth1  scope link
> 209.5.171.95 dev eth1  scope link
> 209.5.171.97 dev eth1  scope link
> 209.5.171.96 dev eth1  scope link
> 209.5.171.99 dev eth1  scope link
> 209.5.171.98 dev eth1  scope link
> 209.5.171.101 dev eth1  scope link
> 209.5.171.100 dev eth1  scope link
> 209.5.171.103 dev eth1  scope link
> 209.5.171.102 dev eth1  scope link
> 209.5.171.105 dev eth1  scope link
> 209.5.171.104 dev eth1  scope link
> 209.5.171.107 dev eth1  scope link
> 209.5.171.106 dev eth1  scope link
> 209.5.171.109 dev eth1  scope link
> 209.5.171.108 dev eth1  scope link
> 209.5.171.111 dev eth1  scope link
> 209.5.171.110 dev eth1  scope link
> 209.5.171.113 dev eth1  scope link
> 209.5.171.112 dev eth1  scope link
> 209.5.171.115 dev eth1  scope link
> 209.5.171.114 dev eth1  scope link
> 209.5.171.117 dev eth1  scope link
> 209.5.171.116 dev eth1  scope link
> 209.5.171.119 dev eth1  scope link
> 209.5.171.118 dev eth1  scope link
> 209.5.171.121 dev eth1  scope link
> 209.5.171.120 dev eth1  scope link
> 209.5.171.123 dev eth1  scope link
> 209.5.171.122 dev eth1  scope link
> 209.5.171.125 dev eth1  scope link
> 209.5.171.124 dev eth1  scope link
> 209.5.171.126 dev eth1  scope link
> 209.5.171.64/26 dev eth0  proto kernel  scope link  src 209.5.171.66
> 192.168.0.0/24 dev eth1  proto kernel  scope link  src 192.168.0.1
> 169.254.0.0/16 dev eth1  scope link
> default via 209.5.171.65 dev eth0
>
>
Steve:
On only a hunch, I''d try to rmmod "ip_nat_ftp". What I
*think* is
happening
is the inbound ftp connection is being seen, but the ip_nat_ftp module
kicks in
because of the use of a private ip address on the dmz host. If that
fixes it, # out
ip_nat_ftp in the modules file in the shorewall directory. Hope it
works...

Jerry Vonau