Hello all,
I have a few OpenBSD servers faithfully running NAT in various spots.
One of these firewalls is doing VERY simple NAT on an interface,

almost a cut and past from the PF pages (only really the IP addresses

got changed).
However, the client wants to be able to connect to an FTP server that

is using TLS.
My first thought of this was "you can't".  however, I was quickly

disabused of this idea by connecting to their server using the program

they use (FileZilla) within a Windows XP instance running inside

Parrallels through a Netlink ADSL modem.  That is two sets of

translation happening!
This got me confused as everything I have read about TLS says this

can't be done.  At least not with NAT.
So I am wondering if anyone has had any experience with this and can

point me in the right direction?
The only way I can think that the Netlink is doing it is by doing some

sort of Dynamic IP Address forwarding (setting up some rule that just

dumps all traffic directly...) but I don't know.
Regards
Mikel

There is, of course, active and passive FTP. In active FTP, the server

connects back to the client; this shouldn't be too difficult to set up,

especially if the FTP server always connects from port 20.
The other way round (passive FTP), you'll either have to integrate your

FTP server with PF or forward a range of ports. vsftpd supports both SSL

and restricting the data ports to a specific range, so that might be a

good way to go about this.
		Joachim
--

TFMotD: perlipc (1) - Perl interprocess communication (signals, fifos,

pipes, safe subprocesses, sockets, and semaphores)

Hello Mikel,
Friday, October 12, 2007, 6:46:20 AM, you wrote:
ML> ... the client wants to be able to connect to an FTP server that

ML> is using TLS.
ML> My first thought of this was "you can't".  however, I was quickly

ML> disabused of this idea by connecting to their server using the program

ML> they use (FileZilla) within a Windows XP instance running inside

ML> Parrallels through a Netlink ADSL modem.  That is two sets of

ML> translation happening!
ML> This got me confused as everything I have read about TLS says this

ML> can't be done.  At least not with NAT.
  I'm confused too. :)

  Why  wont it work over a NAT? You might need to bypass ftp-proxy for that

server (like I did), but only if it's using standard ftp ports (20/21). And

it should be passive, of course.
--

Best regards,

 Boris                            mailto:boris@twopoint.com