On Sat, Jul 07, 2001 at 03:32:47PM +0200, Axel Scheepers wrote:

I'll say it again, FTP is eeeevul.

natd(8) and ipf(8) or natd(8) and ipfw(8)? I'd recommend either using, natd(8) and ipfw(8) or ipnat(8) and ipf(8), and not mixing and matching. There are sometimes reasons to run ipf(8) and ipfw(8) at the same time, but when you need to proxy FTP, there is too much room for confusion and weird interactions.

OK, one more time on how FTP generally works. Everyone knows the client connects to the server on port 21. That's easy. Now as for the data connection, there are two modes, PORT (active) and PASV (passive). In PORT, the client tells the server what port it will be listening on and the _server_ then (usually) connects to the _client_ with a source port of 20 and the arbitrary high port ("ephermeral") the client gave the server as the destination. In PASV, the server tells the client what port it will be listening on, usually an arbitrary high, ephermeral port, and the client then connects with a ephemeral port source to the ephemeral destination. And we should point out that in both modes the server and client are passing not only the port number back and forth, but actually the IP address to connect to as well.

So, the moral of the story is that FTP is an absolute bitch to work with if you have a firewall or NAT'ing gateway between the client and server. You need an application layer proxy for the connection. Redirection alone will not cut it.

Oops. You are really using ipf(8). IPFilter has an FTP proxy built-in. However, use ipnat(8) and not natd(8) with ipf(8).