Ipnat don't work ftp

[rusol]

Hi all, sorry for my English, i'm from Ukraine. I have a problem, after updating the world on the router i can not use ftp, before the upgrade i use ftp normally, telnet to port 21 everything is fine, configs in ipfw and ipnat not made, output of tcpdump:

# tcpdump -i fxp0 -n host 192.168.0.5
20:46:36.477245 IP 192.168.0.5.62184 > 194.186.254.27.21: S 2871545248:2871545248(0) win 65535 <mss 1460,nop,wscale 3,sackOK,timestamp 225844056 0>
20:46:36.477656 IP 192.168.0.3 > 192.168.0.5: ICMP host 194.186.254.27 unreachable, length 68
20:46:39.675247 IP 192.168.0.5.62184 > 194.186.254.27.21: S 2871545248:2871545248(0) win 65535 <mss 1460,sackOK,eol>
20:46:39.675624 IP 192.168.0.3 > 192.168.0.5: ICMP host 194.186.254.27 unreachable, length 56
20:46:42.875117 IP 192.168.0.5.62184 > 194.186.254.27.21: S 2871545248:2871545248(0) win 65535 <mss 1460,sackOK,eol>
20:46:42.875516 IP 192.168.0.3 > 192.168.0.5: ICMP host 194.186.254.27 unreachable, length 56
20:46:42.875730 IP 192.168.0.5.62962 > 213.24.208.27.21: S 3324533308:3324533308(0) win 65535 <mss 1460,nop,wscale 3,sackOK,timestamp 225850456 0>
20:46:42.876144 IP 192.168.0.3 > 192.168.0.5: ICMP host 213.24.208.27 unreachable, length 68
20:46:45.875085 IP 192.168.0.5.62962 > 213.24.208.27.21: S 3324533308:3324533308(0) win 65535 <mss 1460,nop,wscale 3,sackOK,timestamp 225853456 0>
20:46:45.875517 IP 192.168.0.3 > 192.168.0.5: ICMP host 213.24.208.27 unreachable, length 68
20:46:49.075087 IP 192.168.0.5.62962 > 213.24.208.27.21: S 3324533308:3324533308(0) win 65535 <mss 1460,nop,wscale 3,sackOK,timestamp 225856656 0>
20:46:49.075537 IP 192.168.0.3 > 192.168.0.5: ICMP host 213.24.208.27 unreachable, length 68
20:46:52.274864 IP 192.168.0.5.62962 > 213.24.208.27.21: S 3324533308:3324533308(0) win 65535 <mss 1460,sackOK,eol>
20:46:52.275295 IP 192.168.0.3 > 192.168.0.5: ICMP host 213.24.208.27 unreachable, length 56
20:46:55.474715 IP 192.168.0.5.62962 > 213.24.208.27.21: S 3324533308:3324533308(0) win 65535 <mss 1460,sackOK,eol>
20:46:55.475126 IP 192.168.0.3 > 192.168.0.5: ICMP host 213.24.208.27 unreachable, length 56

"ICMP host 213.24.208.27 unreachable":

# ping 213.24.208.27
PING 213.24.208.27 (213.24.208.27): 56 data bytes
64 bytes from 213.24.208.27: icmp_seq=0 ttl=51 time=103.931 ms
64 bytes from 213.24.208.27: icmp_seq=1 ttl=51 time=103.947 ms
64 bytes from 213.24.208.27: icmp_seq=2 ttl=51 time=104.320 ms
64 bytes from 213.24.208.27: icmp_seq=3 ttl=51 time=104.240 ms

ipnat.rules
vr0-internet
fxp0-local

rdr vr0 ip/32 port 80 -> 192.168.0.1 port 80 tcp
rdr vr0 ip/32 port 27015 -> 192.168.0.6 port 27015 udp
map vr0 192.168.0.0/24 -> ip/32 proxy port ftp ftp/tcp
map vr0 192.168.0.0/24 -> ip/32 portmap tcp/udp 40000:60000
map vr0 192.168.0.0/24 -> ip/32 icmpidmap icmp 64000:65535

# uname -rs
FreeBSD 7.2-RELEASE-p2

 

[ProFTP]

in configuration of ftp server it is needed to put some the option, if NAT works

 

[rusol]

I can not log into the аез-servers on the Internet, for example, ftp://ftp.freebsd.org

 

[ProFTP]

firewall blocks probably
ipfw -f flush?

 

[rusol]

"/etc/rc.d/ipfw stop" don't help, i think is the same as "ipfw -f flush"

 

[rusol]

Thank's for all, i fix it, it was necessary to remove the stitch "map vr0 192.168.0.0/24 -> ip/32 proxy port ftp ftp/tcp" from "/etc/ipnat.rules". But why, i never understood. Topic can be closed.