From owner-FreeBSD-net-jp@jp.freebsd.org  Sun Mar 26 13:23:21 2000
Received: (from daemon@localhost)
	by castle.jp.freebsd.org (8.9.3+3.2W/8.7.3) id NAA40866;
	Sun, 26 Mar 2000 13:23:21 +0900 (JST)
	(envelope-from owner-FreeBSD-net-jp@jp.FreeBSD.org)
Received: from mail.openfactory.org (ofs05.openfactory.org [210.136.137.61])
	by castle.jp.freebsd.org (8.9.3+3.2W/8.7.3) with ESMTP id NAA40861
	for <FreeBSD-net-jp@jp.freebsd.org>; Sun, 26 Mar 2000 13:23:20 +0900 (JST)
	(envelope-from ueda@raomen.net)
Received: from soundforce by mail.openfactory.org (8.9.3/3.7Wpl2-99101119) id NAA85008; Sun, 26 Mar 2000 13:22:10 +0900 (JST)
Date: Sun, 26 Mar 2000 13:21:46 +0900
From: UEDA Hiroyuki <ueda@raomen.net>
To: FreeBSD-net-jp <FreeBSD-net-jp@jp.freebsd.org>
Message-Id: <38DD905A2C3.9966UEDA@mail.OpenFactory.ORG>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-2022-JP
Content-Transfer-Encoding: 7bit
X-Mailer: Becky! ver 1.26
Reply-To: FreeBSD-net-jp@jp.freebsd.org
Precedence: list
X-Distribute: distribute version 2.1 (Alpha) patchlevel 24e+000315
X-Sequence: FreeBSD-net-jp 2382
Subject: [FreeBSD-net-jp 2382] cannot connect with FTP server inside firewall
Errors-To: owner-FreeBSD-net-jp@jp.freebsd.org
Sender: owner-FreeBSD-net-jp@jp.freebsd.org
X-Originator: ueda@raomen.net

$B?"ED(B@Raomen.Net $B$H?=$7$^$9!#$A$g$C$HD9$$$G$9$,$4MF<O2<$5$$!#(B

$B!!(BFreeBSD3.2R $BIUB0$N(B ipfw $B$H(B natd $B$G9=C[$7$?(B firewall $B%^%7%s$NFbB&$K$"(B
$B$k!"(BWeb $BMQ$N%^%7%s$K(B Passive $B%b!<%I$G(B ftp $B$r9T$&$H$&$^$/$$$+$J$/$F:$$C(B
$B$F$$$^$9!#(Bnatd, ipfw, pasv $B$J$I$G(B JFUG $B$N8!:w%Z!<%8$+$i8!:w$7$F$_$^$7(B
$B$?$,!"F1$8MM$J>INc$r$_$D$1$i$l$^$;$s$G$7$?$N$G<ALd$5$;$F2<$5$$!#(B


$B!!(BFreeBSD 3.2R $B$N%^%7%s$r?tBfMQ$$$F0J2<$N?^$N$h$&$J%5%$%H$r9=C[$7$F$$(B
$B$^$9!#(BFirewall $B%^%7%s$+$i@lMQ@~%k!<%?$r7PM3$7$F(B Internet $B@\B3$7$F$$$^(B
$B$9$,!"$=$A$i$O4X78$J$5$=$&$J$N$G>JN,$7$^$9!#(B

           ______________________
          |[$B30ItMQ(BDNS = #A]      |
    |-----| AAA.BBB.CCC.10       |
    |     |______________________|
    |
    |      _______________________________
    |     |[Firewall = #C]                |
    |-----| $B30B&(BIP : AAA.BBB.CCC.1        |
          |          AAA.BBB.CCC.2(alias) |
    |-----|          AAA.BBB.CCC.3(alias) |
    |     |_______________________________|
    |
    |      __________________________
    |-----|[Web = #B]  192.168.50.15 |
    |     |__________________________|
    |
    |      __________________________
    |-----|[$BFbItMQ(BDNS] 192.168.50.20 |      |
    |     |__________________________|
    |
    |      __________________________
    |-----|[Mail]  192.168.50.30     |
          |__________________________|

          AAA.BBB.CCC.0/27 : $B%0%m!<%P%k%"%I%l%9(B
          192.168.50.0/24  : $B%W%i%$%Y!<%H%"%I%l%9(B
          redirect_address 192.168.50.15 AAA.BBB.CCC.2
          redirect_address 192.168.50.30 AAA.BBB.CCC.3


$B!!%0%m!<%P%k%"%I%l%9$r;}$C$?(B 1$BBf$N%^%7%s$G(B ipfw $B$H(B natd $B$r;HMQ$7!"FbIt$N(B
$B%W%i%$%Y!<%H%"%I%l%9$N(B 3$BBf$N%^%7%s>e$G!"$=$l$>$l(B $BFbItMQ(B DNS, WWW,
mail$B$N%5!<%S%9$r9T$C$F$$$^$9!#(Bnatd $B$N(B redirect_address $B%*%W%7%g%s$r;X(B
$BDj$7!"(BWeb $B$H(B Mail $B$O30$+$iD>@\%"%/%;%9$G$-$k$h$&$K$J$C$F$$$^$9!#(B

$B!!$3$N$h$&$J9=@.$K$*$$$F!"30It%;%0%a%s%H$KCV$$$F$"$k%^%7%s(B(#A)$B$+$i!"(B
Web $BMQ$N%^%7%s(B(#B)$B$KBP$7$F(B FreeBSD $BI8=`$N(B ftp $B%3%^%s%I$G!"(Bpassive on 
$B$H$7$F(B ftp $B$r9T$&$H!"@\B3$G$-$F(B ls $B%3%^%s%I$N7k2L$J$I$bJV$C$F$/$k$N$G(B
$B$9$,!"(Bpassive on $B8e$O(B ls $B$N7k2L$,JV$C$F$-$^$;$s!#0J2<$N$h$&$J46$8$G$9!#(B

ueda@#A[~ ]ftp #B
Connected to #B
220 #B FTP server (Version 6.00) ready.
Name (#B:ueda): ueda
331 Password required for ueda.
Password:
230 User ueda logged in.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
200 PORT command successful.
150 Opening ASCII mode data connection for '/bin/ls'.
total XXX
-rw-r--r--  1 ueda  users    18 Oct 11 11:28 .aliases
-rw-r--r--  1 ueda  users    16 Oct 11 11:28 .cshrc
-rw-r--r--  1 ueda  users    15 Oct 11 11:28 .exrc
-rw-------  1 ueda  users   677 Mar 26 02:05 .history
-rw-r--r--  1 ueda  users    16 Oct 11 11:28 .login
-rw-r--r--  1 ueda  users    17 Oct 11 11:28 .logout
226 Transfer complete.
ftp> passive on
Passive mode on.
ftp> ls
227 Entering Passive Mode (192,168,50,15,192,22)
ftp: connect: No route to host
ftp> quit

$B!!(BEntering Passive Mode $B$N8e$K%W%i%$%Y!<%H%"%I%l%9$,I=<($5$l$F$7$^$$!"(B
tcpdump$B$J$I$G8+$F$b!"(B 192.168.50.15 $B$K8~$1$F%Q%1%C%H$rAw$C$F$$$k$N$,J,(B
$B$+$j$^$9!#(B $B5U$K(B #B -> #A $B$G$"$l$P(B Passive/$BHs(B Passive $BLd$o$:$K@\B3!"%U%!(B
$B%$%kE>Aw$,2DG=$G$9!#$^$H$a$k$H!"(B

         |  $BHs(BPassive | Passive
-------------------------------
#A -> #B |     $B!{(B     |   $B!_(B
#B -> #A |     $B!{(B     |   $B!{(B

$B$H$J$j$^$9!#(B


$B!!85!9(B FTP $B%5!<%S%9$rDs6!$9$kM=Dj$OL5$$$N$G$9$,!"<+J,$,2?$+@_Dj%_%9$r(B
$B$7$F$$$k5$$,$7$F;EJ}$,$J$$$N$G<ALd$5$;$F$$$?$@$-$^$7$?!#2?$+$4;XE&$$$?(B
$B$@$1$l$P9,$$$G$9!#0J2<$K(B firewall $B%^%7%s(B(= #C) $B$N(B /etc/rc.conf $B$NH4?h(B
$B$H!"(B /etc/natd.conf$B$NFbMF$rE:IU$$$?$7$^$9!#(B

--------- /etc/rc.conf $B$NH4?hFbMF(B --------------
ifconfig_xl0_alias0="inet AAA.BBB.CCC.2 netmask 255.255.255.255"
ifconfig_xl0_alias1="inet AAA.BBB.CCC.3 netmask 255.255.255.255"

natd_program="/sbin/natd"
natd_enable=YES
natd_interface="xl0"
natd_flags="-l -f /etc/natd.conf"
--------------------------------------------

--------- /etc/natd.conf $B$NFbMF(B ------------
redirect_address 192.168.50.15 AAA.BBB.CCC.2
redirect_address 192.168.50.30 AAA.BBB.CCC.3
log             yes
deny_incoming   no
use_sockets     yes
same_ports      yes
unregistered_only       yes
port            8668
----------------------------------------------

$B!!0J>e!"$h$m$7$/$*4j$$$$$?$7$^$9!#(B

---------------------------------------------
$B?"EDM5G7(B : ueda@Raomen.Net

GoodBooks for FreeBSD/Unix
 -->  http://www.Raomen.Net/GoodBooks/
