[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: your mail - sorry for empty subject.

-= dara =- (daramannen@hotmail.com) wrote:

> I believe ip_masq_ftp is only used for enabling FTP clients on the internal
> ( network to connect to an FTP server on the external (internet
> in my case) network. Please correct me if I am wrong.

And the other way arount, iirc.
> What I want, is a way for people on internet to be able to connect (both
> active and passive) to my FTP server. And my FTP server ( is
> located on the internal network.
> With portforwarding, it is possible to make both active and passive
> connections. But with passive it is not possible to fetch any data. I
> believe this is becasue my firewall ( is not accepting the FTP
> servers request to open a new port. Can I make a ipchains rule to allow
> this?

It should work with ipchains, if you allow Packets
from and to Ports 20, 21 and >1024 of your
FTP-Server (syn-Packets *to* the server need only
to go to Port 21). 

The nicer solution is to use connection-tracking
(with Kernel 2.4 and iptables) and the
ip_conntrack_ftp module. This will open just the
ports needed.


Reply to: