Mario Ohnewald wrote:
Hello List!
This is a real easy question, but i will explain it in detail so that you know what i am on about ;)
I have two internet boxes, both have only one nic. Box A is my root box. Box B is a ftp server (where i am not admin, but i have an ftp account).
Both, Box A and B have a public ip address. You can NOT access the ftp server from the outside. ONLY Box A can connect to that ftp server (Box B).
So i though i could simply nat a connection through my Box A, to Box B. If i connect from the real bad world, to my Box A, port 2121. Box A could forward/NAT that to the internal ftp box.
I have tried it with this rule: $IPT -t nat -A PREROUTING -i eth0 -p tcp -d 123.123.123.123 -m helper --helper ftp-2121 -j DNAT --to-destination 123.123.123.111
and
modprobe ip_conntrack_ftp ports=21,2121
But it looks like its not working. I did a tcpdump -i eth0 -n host 123.123.123.111
And no packages where transfered to the ftp box (123.123.123.111). Any idea why? Am i going the right way at all?
Thanks, Mario
You have to add an additional rule: $IPT -A FORWARD -p tcp -i eth1 -d 23.123.123.123 --dport 2121 -j ACCEPT
For this example, eth0 is external and eth1 is internal.
Cheers, Igor Tsinman
igort@xxxxxxxxxxxxxx
