Administrace komentářů

Ahoj, doma mam router (BusyBox) a snazim se na nem rozbehat VSFTPD tak aby byl pristupny z venku. Problem je v tom, ze muj router je schovanej za nejakym jinym routerem myho ISP. ISP mi prevadi 2 tcp porty: 1197,1196. Ja na svym routeru prevadim port 1197 na lokalni 21 a 1196 na lokalni 1196. VSFTD je nastaven tak aby datove spojeni oteviral na portu 1196 a opravdu to tak dela. Ze vnitr mi to funguje, ale z venku (pocitac v praci WinXP, Total Commander) ne zasekne se to na:

"227 Entering passive mode (192,168,0,1,4,72)"
"500 Illegal PORT command"

Zajimava je ta adresa 192.168.0.1 - to je totiz lokalni adresa meho domaciho routeru! Nechapu jak se mohla dostat na pocitac u me v praci! 4,72 odpovida 1196 takze VSFTPD otevre spravny port. Nevite nekdo v cem je problem? Uz se s tim trapim nekolik hodin a nemuzu na to prijit...

iptables:

#!/bin/sh

# $1 WAN-Interface
# $4 LAN-IPAddress

iptables -D INPUT -j DROP

# HTTP - admin web page

iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 1199 -j ACCEPT
iptables -t nat -A PREROUTING -i $1 -p tcp --dport 1199 -j DNAT --to-destination $4:80
# SSH
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 1198 -j ACCEPT
iptables -t nat -A PREROUTING -i $1 -p tcp --dport 1198 -j DNAT --to-destination $4:22
# FTP
iptables -A INPUT -p tcp --dport 21 -j ACCEPT
iptables -A INPUT -p tcp --dport 1197 -j ACCEPT
iptables -t nat -A PREROUTING -i $1 -p tcp --dport 1197 -j DNAT --to-destination $4:21
# FTP data
iptables -A INPUT -p tcp --dport 1196 -j ACCEPT
iptables -t nat -A PREROUTING -i $1 -p tcp --dport 1196 -j DNAT --to-destination $4:1196
iptables -A INPUT -j DROP

xinetd:

service ftp 
{ 
disable = no
socket_type = stream 
user = admin 
server = /opt/sbin/vsftpd 
server_args = /opt/etc/vsftpd.conf 
wait = no 
nice = 10 
only_from = 0.0.0.0/0 
} 

vsftpd.conf:

anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
#anon_upload_enable=YES
#anon_mkdir_write_enable=YES
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
#chown_uploads=YES
#chown_username=whoever
vsftpd_log_file=/opt/var/log/vsftpd.log
#xferlog_std_format=YES
#idle_session_timeout=600
#data_connection_timeout=120
#nopriv_user=ftpsecure
#async_abor_enable=YES
#ascii_upload_enable=YES
#ascii_download_enable=YES
ftpd_banner=Welcome to the NSLU2 vsftp daemon.
#deny_email_enable=YES
#banned_email_file=/opt/etc/vsftpd.banned_emails
#chroot_list_enable=YES
#chroot_list_file=/opt/etc/vsftpd.chroot_list
ls_recurse_enable=YES
secure_chroot_dir=/opt/usr/share/empty
ftp_data_port=1196
pasv_min_port=1196
pasv_max_port=1196