Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to send all FTP traffic to a particular server from a NAT. Server A connects via FTP to an IP which is routed to the NAT and then over a VPN. That traffic then comes back and gets routed from the NAT back to server A. Should be simple enough.

Before routing, I am able to log in perfectly fine if I connect from the NAT instance. Once I add the routes, though, and try to log in from Server A, I can enter my username and password, but it gets rejected. So the connection is established, but my credentials no longer work.

When I take a look at the tcpdump. I get alternating correct/incorrect lines like so:

    remote.ftp.server.here.ftp > server.a.here.internal.43717: Flags [P.], cksum 0x8700 (correct), seq 77:115, ack 35, win 114, options [nop,nop,TS val 2049334718 ecr 2049334718], length 38
15:35:34.144407 IP (tos 0x10, ttl 64, id 36588, offset 0, flags [DF], proto TCP (6), length 52)
    server.a.here.internal.43717 > remote.ftp.server.here.ftp: Flags [.], cksum 0x3a56 (incorrect -> 0xec18), seq 35, ack 115, win 115, options [nop,nop,TS val 2049334728 ecr 2049334718], length 0
15:35:34.144948 IP (tos 0x10, ttl 63, id 36588, offset 0, flags [DF], proto TCP (6), length 52)
    nat.server.here.internal.43717 > server.a.here.internal.ftp: Flags [.], cksum 0xad22 (correct), seq 35, ack 115, win 115, options [nop,nop,TS val 2049334728 ecr 2049334718], length 0
15:35:54.980188 IP (tos 0x10, ttl 64, id 36589, offset 0, flags [DF], proto TCP (6), length 58)
    server.a.here.internal.43717 > remote.ftp.server.here.ftp: Flags [P.], cksum 0x3a5c (incorrect -> 0x2fff), seq 35:41, ack 115, win 115, options [nop,nop,TS val 2049339936 ecr 2049334718], length 6
15:35:54.980779 IP (tos 0x10, ttl 63, id 36589, offset 0, flags [DF], proto TCP (6), length 58)
    nat.server.here.internal.43717 > server.a.here.internal.ftp: Flags [P.], cksum 0xf108 (correct), seq 35:41, ack 115, win 115, options [nop,nop,TS val 2049339936 ecr 2049334718], length 6
15:35:54.980955 IP (tos 0x0, ttl 64, id 5583, offset 0, flags [DF], proto TCP (6), length 66)
    server.a.here.internal.ftp > nat.server.here.internal.43717: Flags [P.], cksum 0x795a (incorrect -> 0x9574), seq 115:129, ack 41, win 114, options [nop,nop,TS val 2049339937 ecr 2049339936], length 14
15:35:54.980975 IP (tos 0x0, ttl 64, id 5584, offset 0, flags [DF], proto TCP (6), length 52)
    server.a.here.internal.ftp > nat.server.here.internal.43717: Flags [F.], cksum 0x794c (incorrect -> 0x8453), seq 129, ack 41, win 114, options [nop,nop,TS val 2049339937 ecr 2049339936], length 0
15:35:54.981337 IP (tos 0x0, ttl 63, id 5583, offset 0, flags [DF], proto TCP (6), length 66)
    remote.ftp.server.here.ftp > server.a.here.internal.43717: Flags [P.], cksum 0xd46a (correct), seq 115:129, ack 41, win 114, options [nop,nop,TS val 2049339937 ecr 2049339936], length 14
15:35:54.981365 IP (tos 0x0, ttl 63, id 5584, offset 0, flags [DF], proto TCP (6), length 52)
    remote.ftp.server.here.ftp > server.a.here.internal.43717: Flags [F.], cksum 0xc349 (correct), seq 129, ack 41, win 114, options [nop,nop,TS val 2049339937 ecr 2049339936], length 0
15:35:54.982424 IP (tos 0x10, ttl 64, id 36590, offset 0, flags [DF], proto TCP (6), length 52)

The two routes that I added for FTP are:

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
DNAT       tcp  --  anywhere             anywhere             tcp dpt:ftp to:server.a.ip:21

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
MASQUERADE  tcp  --  anywhere             anywhere             tcp dpt:ftp

Any idea why this routing would prevent me from logging in to an FTP?

share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.