FTP server behind NAT

Hi all,

I've got an FTP server sitting at 192.168.1.4 in the internal network and am trying to set up the firewall (2.4.29) to allow access to it from outside.

Basically my setup is
1) DNAT one of our static external addresses to the FTP server:

iptables -t nat -A PREROUTING -i pvc0 -d a.b.c.142 \
         -j DNAT --to 192.168.1.4

2) Allow port 21 & related to FTP server and drop everything else iptables -A FORWARD -i pvc0 -o internal -j pvc0-internal

iptables -A pvc0-internal -d 192.168.1.4 -m state \
         --state NEW -p tcp --dport 21 -j ACCEPT

iptables -A pvc0-internal -m state --state ESTABLISHED,RELATED \
-j ACCEPT
iptables -A pvc0-internal -j LOG
iptables -A pvc0-internal -j DROP

3) ip_conntrack_ftp is loaded

Now I can connect from outside to a.b.c.142 and authenticate to the FTP server. But as soon as a new channel is to be opened (e.g. dir listing or file download) the connection hangs.

In /proc/net/ip_conntrack there is a correct(?) entry:

EXPECTING: - use=1 proto=6 src=x.y.z.127 dst=192.168.1.4 \
           sport=0 dport=32985

However the packet from my client (x.y.z.127) is still logged and dropped:
IN=pvc0 OUT=internal SRC=x.y.z.127 DST=192.168.1.4 LEN=60 TOS=0x00 PREC=0x00 TTL=56 ID=15185 DF PROTO=TCP SPT=1557 DPT=32985 WINDOW=5840 RES=0x00 SYN URGP=0

It is really logged and dropped in this chain (added some --log-prefix'es to verify).

Anyone has an idea what is wrong with my setup? Why isn't the packet treated as RELATED and passed through?

Thanks in advance!

Michal Ludvig

* Personal homepage: http://www.logix.cz/michal

maybe you're just leaving this out, but is ip_nat_ftp loaded as well?

-j

--
"Peter: Son, this is a big day for you. Today, you become the man
of the house, because, when we get home, your mother is going to kill me."
--Family Guy

Ehm, no. Shame on me. Now it works, thanks a lot!

Michal Ludvig

* Personal homepage: http://www.logix.cz/michal

/me loves the low hanging fruit.

-j

--
"Quagmire: Hello, 911? It's Quagmire. Yeah, it's caught in the
window this time."
--Family Guy