Port Forwarding FTP with NATD

[Coral_Sea]

I'm using NATD and IPFW on my FreeBSD 4.7 gateway box. I can get port 80 to forward to an inside PC but can't get the FTP port (21) to forward. I tried forwarding both port 20 and 21 but to no avail.

The following lines are in my /etc/rc.conf file:

natd_flags="-redirect_port tcp 192.168.0.2:21 21"
natd_flags="-redirect_port tcp 192.168.0.2:80 80"

Otherwise, my firewall, NATD, and IPFW seem to work fine. Any suggestions.

[kenshi]

Make sure you're forwarding port 20 and the client is set to active mode. I would think that passive mode would work anyway though since the server connects to a port on the client for data transfer. (Be sure the client doesn't have a firewall blocking ports above 1024 though if using passive mode.)

[Coral_Sea]

[quote author=Grand Aardvark Kenshi link=board=10;threadid=6214;start=0#58812 date=1043801620]
Make sure you're forwarding port 20 and the client is set to active mode. I would think that passive mode would work anyway though since the server connects to a port on the client for data transfer. (Be sure the client doesn't have a firewall blocking ports above 1024 though if using passive mode.)
[/quote]

Tried that...and then tried it again. With the FTP server (Pure-FTPD) running on the gateway box, I get the gateway's FTP server from the FTP client (in active or passive mode). If I shut down the gateway FTP server, the FTP ports are closed and I don't get anything. The FTP server on the inside PC (ProFTPD) is definitely up and accepting anonymous logins. Must be some other little trick I'm missing here.

[Coral_Sea]

Ta da! The solution is that you cannot have two natd_flag lines in the rc.conf file as I have shown. I discovered this when I ran ps -ax and saw that the port 80 forward command was executed but not the port 21 command. Actually, what probably happens is that in the sequential execution of the lines in rc.conf, the second natd_flag overwrites the first one.

You can combine more than one -redirect_port command into the same string like so:

natd_flags="-redirect_port tcp 192.168.0.2:21 21 -redirect_port tcp 192.168.0.2:80 80"

With the two natd_flags lines, only the second one was being invoked (i.e., port 80 was getting redirected but not port 21).

There is no need to forward any other port to make FTP port forwarding work (i.e., you do not need to forward port 20).

[kenshi]

Oh, duh. I should've spotted that myself. One of those little things...