mtx
05-06-2008, 08:03 AM
hello to you all. i have a strange problem connecting from a ppp connection made with an Huawei E220 HSDPA USB modem to one of my ftp servers. ALL other ftp connections to this server are working.
I have 2 server's which have the same proftpd configuration, the difference being that the one which doesn't work is behind a pf firewall and the other one is directly connected to the ISP.
topology:
1.
--internet --- [FreeBSD proftpd]
- the above does work
2.
---internet--- ----[mpd4 + pf]---[FreeBSD ftp]
-this doesn't work
Details about 2. :
[B][mpd4 + pf]:
# uname -a
FreeBSD osiris.pilot.lan 6.2-RELEASE-p7 FreeBSD 6.2-RELEASE-p7 #1: Sun Aug 5 15:06:33 EEST 2007 root@osiris.pilot.lan:/usr/obj/usr/src/sys/OSIRIS i386
- pf snippet with the redirection rule to the [FreeBSD ftp] (DMZ_HOST)
rdr pass on $EXT_IF proto tcp from any to $EXT_IF port 21 -> <DMZ_HOST> port 21
rdr pass on $EXT_IF proto tcp from any to $EXT_IF port 59000:59100 -> <DMZ_HOST> port 59000:59100
[FreeBSD ftp]:
- no firewall running
# uname -a
FreeBSD isis 6.2-RELEASE-p6 FreeBSD 6.2-RELEASE-p6 #2: Sun Aug 12 02:12:30 EEST 2007 root@isis:/usr/obj/usr/src/sys/ISIS i386
I have noticed that the ppp connection receives a private IP (172.16/12 class) and on the server the ftp is accessed from an external IP (the connection is nat-ed through that public IP).
Googling around i found out a directive from proftpd AllowForeignAddress (http://www.proftpd.org/docs/directives/linked/config_ref_AllowForeignAddress.html).
Before enabling this on the servers even the 1. server didn't allow connections from that HSDPA modem.
Even though the second one doesn't work. I have tcpdump-ed the connection on the [mpd4+pf] box but no packets get blocked or something.
On the client i have wireshark installed and i will attach the output of that ftp session.
This is all i can think of right now. If more informations are required i'll be glad to provide them.
any hints on where to look further would be nice. thank you.
all the best,
v
I have 2 server's which have the same proftpd configuration, the difference being that the one which doesn't work is behind a pf firewall and the other one is directly connected to the ISP.
topology:
1.
--internet --- [FreeBSD proftpd]
- the above does work
2.
---internet--- ----[mpd4 + pf]---[FreeBSD ftp]
-this doesn't work
Details about 2. :
[B][mpd4 + pf]:
# uname -a
FreeBSD osiris.pilot.lan 6.2-RELEASE-p7 FreeBSD 6.2-RELEASE-p7 #1: Sun Aug 5 15:06:33 EEST 2007 root@osiris.pilot.lan:/usr/obj/usr/src/sys/OSIRIS i386
- pf snippet with the redirection rule to the [FreeBSD ftp] (DMZ_HOST)
rdr pass on $EXT_IF proto tcp from any to $EXT_IF port 21 -> <DMZ_HOST> port 21
rdr pass on $EXT_IF proto tcp from any to $EXT_IF port 59000:59100 -> <DMZ_HOST> port 59000:59100
[FreeBSD ftp]:
- no firewall running
# uname -a
FreeBSD isis 6.2-RELEASE-p6 FreeBSD 6.2-RELEASE-p6 #2: Sun Aug 12 02:12:30 EEST 2007 root@isis:/usr/obj/usr/src/sys/ISIS i386
I have noticed that the ppp connection receives a private IP (172.16/12 class) and on the server the ftp is accessed from an external IP (the connection is nat-ed through that public IP).
Googling around i found out a directive from proftpd AllowForeignAddress (http://www.proftpd.org/docs/directives/linked/config_ref_AllowForeignAddress.html).
Before enabling this on the servers even the 1. server didn't allow connections from that HSDPA modem.
Even though the second one doesn't work. I have tcpdump-ed the connection on the [mpd4+pf] box but no packets get blocked or something.
On the client i have wireshark installed and i will attach the output of that ftp session.
This is all i can think of right now. If more informations are required i'll be glad to provide them.
any hints on where to look further would be nice. thank you.
all the best,
v