I'm facing the following issue with Linux kernel 4.10-28-generic, embedded in Ubuntu-16.04.02-LTE. My machine has two ethernet adapters, namely the following ones:
enp0s3: 188.8.131.52 (internal network)
enp0s8: 172.22.181.41 (external network)
In the internal network, connected to enp0s3, there is an FTP server and a telnet server I want to access from the external
network connected through enp0s8.
The FTP mode is requested to be active.
To accomplish this task I use the following iptables rules:
modprobe nf_conntrack_ftp modprobe nf_nat_ftp sh -c "echo 1 > /proc/sys/net/ipv4/ip_forward" ## Masquerade settings iptables -A POSTROUTING -t nat -o enp0s3 -j MASQUERADE iptables -A POSTROUTING -t nat -o enp0s8 -j MASQUERADE ## ftp rules iptables -t nat -I PREROUTING -p tcp -m tcp --dport 20 -i enp0s8 -j DNAT --to-destination 192.168.56.2:20 iptables -t nat -I PREROUTING -p tcp -m tcp --dport 21 -i enp0s8 -j DNAT --to-destination 192.168.56.2 iptables -t nat -I PREROUTING -p tcp -m tcp --dport 1024:65535 -i enp0s8 -j DNAT --to-destination 192.168.56.2:1024-65535 ## telnet rules iptables -t nat -I PREROUTING -p tcp -m tcp --dport 23 -i enp0s8 -j DNAT --to-destination 192.168.56.2`
These rules work well with Ubuntu-10, that has Linux kernel 2.6.32-38-generic, but with the new kernel data connection can't be established: when the client issues the PORT command, the server receives the IP address of the external network and not that of the internal one. According to "netstat" running on server side, it seems that the module "nf_nat_ftp" is not working well, that is it does not substitute the client IP address (external address) with that of the input interface enp0s8, (internal address) before forwarding the command to the server. For this reason the server get stuck trying to establish a connection with the external IP address (SYN state).
No problem with the FTP working in passive mode and with telnet connection as well.
Could you give me a suggestion to overcome this issue? Is it a regression or am I expected to change my iptables rules according to some new requirements?
Thank you in advance!
Best regards, Stefano