top button
Flag Notify
    Connect to us
      Site Registration

Site Registration

Netfilter: nat ftp helper bypass

+1 vote

Is there a way to bypass nat ftp helper for a few connections and allow the rest of the FTP connections to NAT with the FTP helper module ?

The need is to NAT the FTP control and data connections without conntrack-helpers .

posted Oct 8, 2013 by Luv Kumar

Share this question
Facebook Share Button Twitter Share Button LinkedIn Share Button

2 Answers

+1 vote

See man iptables, specifically the raw table:

This table is used mainly for configuring exemptions from connection tracking in combination with the NOTRACK target. It registers at the netfilter hooks with higher priority and is thus called before ip_conntrack, or any other IP tables. It provides the following built-in chains: PREROUTING (for packets arriving via any network interface) OUTPUT (for packets generated by local processes)

answer Oct 8, 2013 by Naveena Garg
The setup is a router and I m tryin to SNAT so the choice i have is on FORWARD / POSTROUTING chain.
I need connection tracking as i need to NAT the traffic without the nat ftp helper module .
+1 vote

Look at these pages:

I've never had to use the raw table nor the NOTRACK target so my info is likely hardly authoritative. But, I guess it would work something like this:

$ipt -t raw -A PREROUTING -d  -p tcp -m multiport --dports 20,21 -j NOTRACK
$ipt -t raw -A PREROUTING -s  -p tcp -m multiport --dports 20,21 -j NOTRACK

If I understand things correctly, this should make connections to/from the specified FTP server untracked.
After that, you'd need static NAT rules to forward packets to and from the FTP server. I don't know if Netfilter does NAT without connection tracking. If not, then maybe iproute2 can help you there:

answer Oct 8, 2013 by Naveena Garg
Similar Questions
+3 votes

Which local IP address does FTP select to connect to remote when it has multiple IP addresses ?

+3 votes

I want to setup a FTP server on a machine which has only 3G or 4G connection no wifi/broadband. How to proceed any pointer would be helpful?