natd & passive FTP not working

Niklas Saers Mailinglistaccount niklasmls at
Sat May 24 03:18:15 PDT 2003

Hi, I'm running a FreeBSD firewall and have a FTP server on the inside of
this (the firewall is the outer firewall of a dmz, and yes, I need the FTP).
My problem is that passive connections from the outside seem to die, but
active connections live. I wasn't expecting active connections to live,
but I don't mind that. But please, how do I connect with passive FTP?

This is what happens from an outside box:

$ ftp ftp://user:pass@
Connected to
220 FTP server (Version 6.00LS) ready.
331 Password required for user.
230 User user logged in, access restrictions apply.
200 Type set to I.
250 CWD command successful.
ftp> ls
ftp: connect: Operation timed out
ftp> passive
Passive mode off.
ftp> ls
200 PORT command successful.
150 Opening ASCII mode data connection for '/bin/ls'.
total 12
drwxr-xr-x  2 user  users  512 May 17 16:10 bin
226 Transfer complete.

My firewall has the following in it's natd.config:
interface fxp0
punch_fw 9000:800
deny_incoming yes
log_ipfw_denied yes
log yes
redirect_port tcp
redirect_port tcp
redirect_port udp
redirect_port udp

My fxp0 has IP and my fxp2 has IP

My firewall rules are for the moment:
00100  51820 26378787 divert 8668 ip from any to any via fxp0
00200 179730 75469049 allow ip from any to any

(I'll tighten them more as soon as I've got all of this running. But I
figure natd takes most already)

So again, how do I make passive FTP work for this setup?



More information about the freebsd-questions mailing list