Subject: NAT, PASV, and "connection refused"

From: Paul Robertson <[email-masked]>
Date: Fri, 16 Apr 1999 22:29:16 -0400 (EDT)

Our public wu-ftpd server (2.4.2-vr16 on RedHat 5.2) is sitting behind
an Iproute box that does address translation and packet-filtering for
us. The ftp server has a private IP address behind the Iproute box. All
outbound traffic is permitted by the packet filter. Only inbound packets
on specific ports are permitted. Pretty standard stuff, I think.

We discovered yesterday that we had problems with FTP clients that ran
in passive mode. After doing a little research, we:

 - added the following lines to the /etc/ftpaccess file:

   passive address 192.168.2.112  192.168.2.0/24
   passive address 206.123.123.123 0.0.0.0/0
   passive ports 0.0.0.0/0 33300 33350

   The intent was that internal clients would see the private
   address. External clients would see the public address (which gets
   translated 192.168.2.112). We also configured the packet-filter to
   allow port range 33300-33350 inbound for the client connects to the
   server data port.

Unfortunately, when we attempt a passive connection from an external
ftp client, we see the following:

petunia:~>ftp ftp.whatever.com
Connected to ftp.whatever.com.
220 gatekeeper.whatever.com FTP server ready.
Name (ftp.whatever.com:smith): ftp
331 Guest login ok, send your complete e-mail address as password.
Password:
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> pass
Passive mode on.
ftp> dir
227 Entering Passive Mode (206,123,123,123,139,128)
ftp: connect: Connection refused

>From an external address, I can telnet to 206.123.123.123 on all ports
in the range 33300 to 33350, so I know that the packet filter is
passing the packets. What's very strange is that when I run "netstat
-a" on the ftp server after running the PASV command, I see the
following entry:

Active Internet connections (including servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 206.123.123.123:35712   *:*                     LISTEN

So the server IS listening on the data port, but why is the "Local
Address" the EXTERNAL IP address (203.123.123.123), and not the internal
(192.168.2.112) address? Does this imply that the ftp server is somehow
listening on another address? Even from the internal network, with the
listening connection as above, I cannot complete the transfer with
"telnet 192.168.2.112 35712": I get "connection refused".

In the ftpaccess man page, the relevant note says:

 "NOTE: this does not change the address the daemone actually lis-
  tens on, only the address reported to the client.  This feature
  allows the daemon to operate correctly behind IP-renumbering
  firewalls."

Any suggestions as to why external ftp clients are unable to connect
in passive mode? I've scanned the archives and cannot find anything
that seems relevant to my experience.
  
Thanks in advance,
  
Paul

-- 
Paul Robertson
Phone:   (781) 213-9101  Fax: (508) 793-2972 
E-Mail:  [email-masked]