Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[rcamkerr]

We have an internet connection through another companies fibre connection. Our external ip addresses are assigned to us through the other companies router. Our DFL-210 is set up with external ip addresses of 172.18.1.101-105. These addresses have all been published in the ARP entries. We have two
webservers setup and working.  I would like to setup an ftp server as well. I used the instructions in the manual for setting up the rules. There must be some other rule(s) I must need to add for our unique setup. Any help or suggestions would be appreciated.

Actual external IP address for the ftp server is xx.xx.xx.174 in the logs below.
ftp server wan_ip_4: 172.18.1.104
dmz ip address: dmz_4

ftp_sat
Action: SAT
service: ftp-inbound

source interface: any
destination interface: core
source network: all-nets
destination network: wan_ip_4
SAT: destination IP
     new address: dmz_4
     new port: 21

ftp_nat
Action: NAT
Service: ftp-inbound

source interface: dmz
destination interface: dmz_4
source network: core
destination network: wan_ip_4
NAT: Specify sender IP
     new IP address: dmz_4

ftp_allow
Action: Allow
Service: ftp-inbound

source interface: any
destination interface: core
source network: all-nets
destination network: wan_ip_4

Now what I see in the logs is:

2009-12-21             RULE                                                    xx.xx.xx.174    15801    ruleset_drop_packet
11:14:01    Warning  6000051    Default_Rule TCP    wan           172.18.1.104   21        drop
ipdatalen=28 tcphdrlen=28 syn=1

[rcamkerr]

I seem to be getting a bit closer.

I changed the destination interface from core to any. I now am able to log in, but do not get a directory listing. The ftp client issues the port command, the server receives the port and returns successful. In the server log it registers that the connection was closed from the client side. In the DFL-210 logs I see alg_session_open then alg_session_closed immediately after. Then the rest of the ftp ports get closed.

I have tried a couple of different ftp clients. They both fail trying to retrieve the directory listing.

[chechito]

First of all

use service: ftp-passthrough to exclude de ALG from the situation

y suggest you the following rules:
# Name              Action   Source int  Source net   Dest int   Dest net   Service
1 ftp_sat_inb       SAT      wan          all-nets        core       wanip        ftp-passthrough
2 ftp_allow_inb     Allow    wan          all-nets        core       wanip        ftp-passthrough
3 ftp_nat_out       NAT     dmz          ftpsrvip        wan       all-nets      ftp-passthrough

on the sat rule
     new address: ftpsrvip
     new port: (not needed leave blank)

[rcamkerr]

chechito, thanks for your suggestions. However, I still end up with the same problem. It appears the DFL-210 closes the connection. The server has accepted the connection but logs that the client side closed the connection.
I will continue to hack at it.