# ipnat + ipfw - ftp connection



## jishnu (Apr 10, 2012)

Hello,

I have a problem with ftp connection (active) from my internal networks to the outside ftp server. The ftp (passive) connection works fine from any machine without harm. I have two subnets 192.168.1.0/24 and 192.168.2.0/24 [FreeBSD 8.2-RELEASE-p6]

*S*ample of ipnat.rules:

```
[B]map em0 192.168.0.0/16 -> xx.xx.xx.xx/32 proxy port ftp ftp/tcp[/B]
rdr em1 0/0 port 80 -> 192.168.1.1 port 3128
rdr rl0 0/0 port 80 -> 192.168.2.1 port 3128
map em0 192.168.1.0/24 -> xx.xx.xx.xx portmap tcp/udp auto
map em0 192.168.1.0/24 -> xx.xx.xx.xx icmp
map em0 192.168.2.0/24 -> xx.xx.xx.xx portmap tcp/udp auto
map em0 192.168.2.0/24 -> xx.xx.xx.xx icmp
rdr em0 xx.xx.xx.xx/32 port 2222 -> 192.168.2.63 port 80

...
```
and *I* put that rule for the testing purposes:

```
ipfw add 00001 allow all from any to any
```

*F*ound also half solution which is changing line:

```
map em0 [B]192.168.0.0/16[/B] -> xx.xx.xx.xx/32 proxy port ftp ftp/tcp
```
to

```
map em0 [B]192.168.1.8/32[/B] -> xx.xx.xx.xx/32 proxy port ftp ftp/tcp
```
and now ftp active connection works (on one PC).

*T*he problem is: how to make rule to fix ftp active connections to all computers? I think it's better solution than put 1 rule for every PC.

The line seems not work at all:

```
map em0 [B]192.168.0.0/16[/B] -> xx.xx.xx.xx/32 proxy port ftp ftp/tcp
```

Thank you for any suggestions


```
211 End
Connect ok!
PWD
257 "/"
Download folder
TYPE A
200 Switching to ASCII mode.
PORT 192,168,1,8,210,185
500 Illegal PORT command.
```


----------



## jishnu (Apr 16, 2012)

*another little question*

Maybe it's wrong topic but *I* have another question:

Why that rule doesn't work (try to block 192.168.1.8 to any):

```
ipfw add 00001 deny all from 192.168.1.0/30 to xx.xx.xx.xx
```

*I*nstead *I* must use:

```
ipfw add 00001 deny all from 192.168.1.8/30 to xx.xx.xx.xx
or
ipfw add 00001 deny all from 192.168.1.8/32 to xx.xx.xx.xx
```
*H*ow can *I* block 30bit mask? *O*n linux that mask work*s*. *S*eems *I* don't understand something.


----------



## jishnu (Apr 21, 2012)

I still haven't managed to solve the problem. One way to solve it is to make a script that will add a rule for every PC, but I would like to make MASKS work like they should.

Any suggestions?


----------

