linux poison RSS
linux poison Email

FTP port forwarding using Iptables

Well, let’s imagine rather trivial situation: you have Linux router connected to Internet via e.g. ADSL modem and some local network comprising several computers and servers connected to that router via switches and/or Wi-Fi access points.

Done? Ok.

There is one public IP assigned to WAN interface of the router while FTP server (of course run by Linux as well) has IP something like or 172.16.*.* or 10.*.*.*. Moreover you want to allow people to access your FTP from every corner of Internet… So, there are several ways how to apply this but let’s talk about how to achieve this by means of using port forwarding feature that is available in any router’s functions list.

So, let’s say we have the following configuration:

Internet <-> [a] router [b] <-> [c] FTP server

[a] is WAN interface with (just an example) IP assigned to it, [b] is NIC with and [c] is server’s interface with IP All what we need is that users from Internet can access FTP server using IP and default 21 TCP port.

One of the main problems is that passive mode of FTP service uses any port from range 1024 to 65535 so it’s not enough to forward 21/20 ports to FTP server and let the ball rolling. So, go to servers’ CLI and open configuration file of an FTP service. It would be vsftpd, proftpd whatever. Let’s say we have vsftpd so we have to add the following lines to /etc/vsftpd.conf:


When changes are saved restart vsftpd server.

Now access router’s CLI and type the following:

iptables -t nat -I PREROUTING -d -p tcp -m tcp --dport 21 -j DNAT --to-destination

iptables -t nat -I PREROUTING -d -p tcp -m tcp --dport 12000:13000 -j DNAT --to-destination

This will add netfilter port forwarding rules which will redirect traffic coming at routers’ public IP through 21 TCP port to FTP server and will properly handle passive FTP mode.


Anonymous said...

never test with a cli client
Use a good client like FILEZILLA

Anonymous said...

Always use a decent client to test.
FileZilla is one.

Post a Comment

Related Posts with Thumbnails