Chapter 8 – Frequently Asked Questions (FAQs)
Multi-Tech Systems, Inc. RouteFinder RF850/860 User Guide (PN S000400E)
145
Q15. I want to use DNAT with multiple original IPs, but my external NIC has just one IP.
How can I do this?
A15.
Make sure that the request reaches the RouteFinder, and then use DNAT to redirect the request to the Web
servers. There are two ways to do this:
1. Bind an alias to the external interface, so that it answers ARP requests for this address and the packets are
sent to the MAC address of this NIC. You can do this in
Network Setup > Interface
(refer to Chapter 3).
2. Tell your router to send those packets directly to the RouteFinder's interface by adding a static routing entry
to the RouteFinder.
Q16. My FTP clients want to use FXP transfers on my Server. How can I do that?
A16.
For a fully functional FTP server (able to do FXP), the RouteFinder's "stateful inspection" function is not
enough. Due to security concerns, the RouteFinder will only allow data connections from and to the same client
IP as the control connection.
The example below shows how to make a "glftpd" server work behind a RouteFinder, which does both packet
filtering and DNAT. The general principle applies to all other FTP servers too, so you can use it even if you use
another server daemon.
Let‘s assume that you have
glftpd
set up in your LAN on address 192.168.1.10 with control port 23456. Your
external, official IP on the RouteFinder is 1.2.3.4.
Go
to
Networks & Services > Networks
and define the host entries for FTP server and external RouteFinder
interface:
FTP_Server 192.168.1.10 255.255.255.255
ASL_Extern 1.2.3.4 255.255.255.255
Go to Networks & Services > Services and define entries for the control connection and the passive mode port
range that the RouteFinder will use.
FTP_ALTControl TCP 1024:65535 23456
PASV_Range TCP 1024:65535 3000:4000
Note that we selected the ports from 3000-4000 to be our passive connection range in this example. You
should select a range matching your setup, do not make it too small, and make sure you do not need any ports
in this range for other services.
Go to Packet Filters > Packet Filter Rules and add the following rules:
Any FTP_ALTControl FTP_Server Allow
This rule allows connections of clients to the FTP server.
FTP_Server Any Any Allow
This rule allows the FTP server to make outgoing connections to clients, thus enabling the PORT command.
Any PASV_Range FTP_Server Allow
This rule allows connections from clients to the passive port range of the FTP server (needed to make passive
mode work).
Add the DNAT rules. Go to Network Setup > DNAT and add the following definitions:
ASL_extern FTP_ALTControl FTP_Server FTP_ALTControl
ASL_extern PASV_Range FTP_Server PASV_Range
The RouteFinder setup is done. However, the FTP server does not know that it is placed behind a DNAT
firewall, and thus will give out his 192.168.1.10 address when replying to a PASV command. In addition, we
must tell it only to use the ports in our PASV_Range for passive connections.
Nearly all FTP servers have configuration options to set the IP and port range used for passive mode. In this
case with
glftpd
, these are the options:
pasv_addr 1.2.3.4 1
pasv_ports 3000 4000
See
glftpd.docs
for more info on those configuration options, or check the docs of your particular FTP server if
you use another daemon.
Q17. Do I need to add routes for my connected networks?
A17.
No, you never have to add routes for networks in which your RouteFinder is a member. These so-called
"Interface Routes" are automatically added by the RouteFinder itself.
Q18. I have DNAT set up but I cannot connect to the translated services. What is wrong?
A18.
You may need to set packet filter rules to allow the traffic. When using DNAT, you must allow the traffic
according to the characteristics BEFORE the translation.
For example:
If you translate
1.2.3.4:80
into
192.168.1.10:80
, you must allow
Any->1.2.3.4 port 80 TCP
(http).
When using SNAT, you must allow the traffic according to the characteristics after the translation. For example:
If you translate
SRC 192.168.10.1
into
SRC 1.2.10.1
, you must allow
1.2.10.1 -> any -> any
.
(Note that these are examples only!)
