Christopher Chan wrote:
Henrik Nordstrom wrote:Take a FTP server, which is behind such a nat device.Technically agreed, except that route NAT for the same reason does not work for protocols not NAT friendly such as FTP, IRC or many other.
Regards Henrik
Could you explain this a bit more?
How would they be broken in a route nat for all protocols to a virtual ip that is sent a box on the inside network?
Client connects to 21 port, is redirected to ftp server at say 192.168.1.2:21 and issues dir command;
ftp server starts to listen on port 1025 for another connection from client for file list to be returned, therefore it sends client
PORT 192,168,1,2,1,1;
client gets this information and tries to connect to 192.168.1.2:1025 which is on his private network, therefore, this directory listing is not received to client.
I can understand when we speak of multiple ftp clients on the inside network going through a nat box that will only map them all to a single external ip. But for one to one full nat mappings?
We also get a bonus in that we can still implement firewalling for one to one mappings via the FORWARD chain in the filter table without having to load conntrack at all.
Christopher. - : send the line "unsubscribe linux-net" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
-- Aidas Kasparas IT administrator GM Consult Group, UAB - : send the line "unsubscribe linux-net" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
