ipnat + ipfw - ftp connection

J

jishnu

Hello,

I have a problem with ftp connection (active) from my internal networks to the outside ftp server. The ftp (passive) connection works fine from any machine without harm. I have two subnets 192.168.1.0/24 and 192.168.2.0/24 [FreeBSD 8.2-RELEASE-p6]

Sample of ipnat.rules:
Code: 
[B]map em0 192.168.0.0/16 -> xx.xx.xx.xx/32 proxy port ftp ftp/tcp[/B]
rdr em1 0/0 port 80 -> 192.168.1.1 port 3128
rdr rl0 0/0 port 80 -> 192.168.2.1 port 3128
map em0 192.168.1.0/24 -> xx.xx.xx.xx portmap tcp/udp auto
map em0 192.168.1.0/24 -> xx.xx.xx.xx icmp
map em0 192.168.2.0/24 -> xx.xx.xx.xx portmap tcp/udp auto
map em0 192.168.2.0/24 -> xx.xx.xx.xx icmp
rdr em0 xx.xx.xx.xx/32 port 2222 -> 192.168.2.63 port 80

...
and I put that rule for the testing purposes:
Code: 
ipfw add 00001 allow all from any to any

Found also half solution which is changing line:
Code: 
map em0 [B]192.168.0.0/16[/B] -> xx.xx.xx.xx/32 proxy port ftp ftp/tcp
to
Code: 
map em0 [B]192.168.1.8/32[/B] -> xx.xx.xx.xx/32 proxy port ftp ftp/tcp
and now ftp active connection works (on one PC).

The problem is: how to make rule to fix ftp active connections to all computers? I think it's better solution than put 1 rule for every PC.

The line seems not work at all:
Code: 
map em0 [B]192.168.0.0/16[/B] -> xx.xx.xx.xx/32 proxy port ftp ftp/tcp

Thank you for any suggestions

Code: 
211 End
Connect ok!
PWD
257 "/"
Download folder
TYPE A
200 Switching to ASCII mode.
PORT 192,168,1,8,210,185
500 Illegal PORT command.
 
another little question

Maybe it's wrong topic but I have another question:

Why that rule doesn't work (try to block 192.168.1.8 to any):
Code: 
ipfw add 00001 deny all from 192.168.1.0/30 to xx.xx.xx.xx

Instead I must use:
Code: 
ipfw add 00001 deny all from 192.168.1.8/30 to xx.xx.xx.xx
or
ipfw add 00001 deny all from 192.168.1.8/32 to xx.xx.xx.xx
How can I block 30bit mask? On linux that mask works. Seems I don't understand something.
 
I still haven't managed to solve the problem. One way to solve it is to make a script that will add a rule for every PC, but I would like to make MASKS work like they should.

Any suggestions?
 
You must log in or register to reply here.
Back
Top