On Fri, Oct 12, 2007 at 09:46:20PM +1000, Mikel Lindsaar wrote:

quoted text
> Hello all,

>

> I have a few OpenBSD servers faithfully running NAT in various spots.

>

> One of these firewalls is doing VERY simple NAT on an interface,

> almost a cut and past from the PF pages (only really the IP addresses

> got changed).

>

> However, the client wants to be able to connect to an FTP server that

> is using TLS.

>

> My first thought of this was "you can't".  however, I was quickly

> disabused of this idea by connecting to their server using the program

> they use (FileZilla) within a Windows XP instance running inside

> Parrallels through a Netlink ADSL modem.  That is two sets of

> translation happening!

>

> This got me confused as everything I have read about TLS says this

> can't be done.  At least not with NAT.

>

> So I am wondering if anyone has had any experience with this and can

> point me in the right direction?

>

> The only way I can think that the Netlink is doing it is by doing some

> sort of Dynamic IP Address forwarding (setting up some rule that just

> dumps all traffic directly...) but I don't know.

There is, of course, active and passive FTP. In active FTP, the server

connects back to the client; this shouldn't be too difficult to set up,

especially if the FTP server always connects from port 20.
The other way round (passive FTP), you'll either have to integrate your

FTP server with PF or forward a range of ports. vsftpd supports both SSL

and restricting the data ports to a specific range, so that might be a

good way to go about this.
		Joachim
--

TFMotD: perlipc (1) - Perl interprocess communication (signals, fifos,

pipes, safe subprocesses, sockets, and semaphores)