Re: FTPD Help

From: Jed Clear (clear_at_alum.mit.edu)
Date: 09/11/03 

Date: Thu, 11 Sep 2003 01:23:40 GMT

Joe Doupnik wrote:
> -------------
> "Normal" mode for FTP is for the server (ftpd) to offer a port
> to the client, no matter which way data will flow. It does this by
> sending a PORT command detailing the IP number and TCP port number now
> open by the server.
> "Passive" mode for FTP is for the client to make the PORT offer
> instead. The server can use any local port it wishes to make the outward
> connection.

I think you have client and server reversed. The party initiating the
FTP control connection is the "client" or, more properly in FTP
parlance, user. In Active(normal) mode the server initiates the TCP data
connection to the client. PORT is used by the client to modify the
address and port that the server connects to.

In passive (PASV) mode the client asks the server for an address and
port to make the data connection to on the server. The server then
passively listens for a connection on that port. The TCP data
connection is then initiated to that server, usually by the client, but
it can be a third party server in active mode.

Check out section 3.2 of the RFC
ftp://ftp.rfc-editor.org/in-notes/rfc959.txt and refer to figures 1 and
2 of section 2.3.

[snip good stuff about pitfalls of NAT, and original FTP design]

OP, if you were using ipfw and natd on your "router", you could to look
at the natd -punch_fw option. A few tricks are: don't set your "router"
kern.securelevel above 2, make sure you generally allow new outbound TCP
connections in your ipfw rules, and set the -punch_fw basenumber to a
number higher than your divert rule. The rules get installed 100 apart
by default. If your divert rule is at 2000, then "-punch_fw 2010:16"
will work. Read the natd(8) section on punch_fw carefully before
tailoring those numbers to your requirements. This would let you do
both active and passive through the "router". Of course using port 2121
could break punch_fw.

Your "router" appears to be something else. A working understanding of
how the FTP protocol connections happen, and your "routers"
documentation should at least let you see what's possible. Many can't
deal with the problems Joe mentions. If you can't get your "router" to
sit up and beg properly; put it aside, dust off an old 486, install
FreeBSD and 2 NICs, and then use ipfw and natd.

I've been putting "router" in quotes because it is really the NAT and
firewall functionality that is giving you problems, and traditionally
that isn't a routers primary job.

HTH,

-Jed

Relevant Pages

  • Re: Cost of setting up a network
    ... A router capable of acting as a VPN endpoint for more than one user simultaneously with four Ethernet ports or a switch to suit. ... The rationale for using a server here is basically that the router doesn't need to be able to decide which PC to route the connection to. ... If you are using a router which supports it, you can set up a port-forwarding inbound rule which also _translates_ the port supplied to the receiving port. ... You can use several of these connections to different machines simultaneously. ...
    (uk.comp.homebuilt)
  • Re: Using Remote Desktop From an SBS Domain
    ... when you tried to RDP while attached directly to a port on your router? ... So if 3389 needs forwarded on the client end too then that is what the ... Hopefully next week I can attempt a connection while my ISP watches the ...
    (microsoft.public.windows.server.sbs)
  • Re: Unable to print to networked printer - get access denied messa
    ... Check the permissions on the server assuming the client has a true RPC ... How is the Standard TCP/IP port configured for the device? ...
    (microsoft.public.windowsxp.print_fax)
  • Re: Still cant connect to RWW or OWA remotely
    ... No Phantom NICs as far as I can see. ... that it can not find the server. ... Configure your Router as an Eithernet Bridge. ... Once you have this then configure the Routers Firewall and Port ...
    (microsoft.public.windows.server.sbs)
  • Re: Still cant connect to RWW or OWA remotely
    ... No Phantom NICs as far as I can see. ... that it can not find the server. ... Configure your Router as an Eithernet Bridge. ... Once you have this then configure the Routers Firewall and Port ...
    (microsoft.public.windows.server.sbs)