[CentOS] DNAT rule for vsftp --(PASSIVE FTP)

Indunil Jayasooriya indunil75 at gmail.com
Fri Oct 5 06:31:56 UTC 2007

On 10/5/07, Feizhou <feizhou at graffiti.net> wrote:
> >     Do you have ip_nat_ftp loaded too?
> >
> >
> > YES, both ip_conntrack_ftp and ip_nat_ftp.
> >  pls see below
> >
> > #Enable tracking mechanism
> > /sbin/modprobe -a ip_conntrack_ftp ip_nat_ftp
> Hmm, I think the NEW for port 1024: is not necessary in FORWARD then.
> The nat_ftp should handle it and thus make it ESTABLISHED,RELATED and
> the ESTABLISHED,RELATED rule should therefore be sufficient.

That meas I do not nedd below rule i FORWARD chain.

iptables -A FORWARD -p tcp -d --dport 1024: -m state --state

So below 3 rules will be enough.

iptables -t nat -A PREROUTING -p tcp -i eth0 -d --dport 21 -j DNAT
iptables -t nat -A PREROUTING -p tcp -i eth0 -d --dport 1024: -j
DNAT --to-destination

iptables -A FORWARD -p tcp -d --dport 21 -m state --state NEW

Thank you
Indunil Jayasooriya
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.centos.org/pipermail/centos/attachments/20071005/f306a1cb/attachment.htm

More information about the CentOS mailing list