☰

ftp nat/端口转发不起作用

tag-icon • tag-icon ftp nat port-forwarding
ftp nat/端口转发不起作用

我有以下环境：

  • 我的电脑作为 ftp 客户端

  • 一个启用了防火墙并遵循以下规则的服务器（名为 HOST）：

    public (active)
target: ACCEPT
icmp-block-inversion: no
interfaces: ens192
sources:
services: ssh dhcpv6-client ftp
ports: 20023/tcp 29000-29100/tcp 20021/tcp 21/tcp
protocols:
masquerade: yes
forward-ports: port=20023:proto=tcp:toport=23:toaddr=10.1.1.2
        port=29000-29100:proto=tcp:toport=29000-29100:toaddr=10.1.1.2
        port=20021:proto=tcp:toport=21:toaddr=10.1.1.2
        port=21:proto=tcp:toport=21:toaddr=10.1.1.2
source-ports:
icmp-blocks:
rich rules:

  • 服务器 HOST 内的虚拟服务器（名为 APP），其上有一个 FTP 服务器，其被动端口范围在 29000 到 29100 之间

服务器HOST的网络配置为：

ens192: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1492
        inet 10.10.12.6  netmask 255.255.255.0  broadcast 10.10.12.255

tap0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.1.1.1  netmask 255.255.255.0  broadcast 10.1.1.255

当我尝试从我的客户端（使用 filezilla）连接到 APP ftp 服务器时，登录有效，但 DIR、GET 或其他无效，而且我不知道如何正确配置我的环境。

有人可以帮忙吗？谢谢。

更新 1 FILEZILLA 调试日志

Stato:  Connessione a 10.10.12.6:20021...
Stato:  Connessione stabilita, in attesa del messaggio di benvenuto...
Trace:  CFtpControlSocket::OnReceive()
Risposta:   220-FTPDZDT1 IBM FTP CS V2R3 at APP, 11:47:16 on 2019-03-01.
Trace:  CFtpControlSocket::OnReceive()
Risposta:   220 Connection will close if idle for more than 5 minutes.
Trace:  CFtpControlSocket::SendNextCommand()
Comando:    AUTH TLS
Trace:  CFtpControlSocket::OnReceive()
Risposta:   534 Server is not willing to accept security mechanism
Trace:  CFtpControlSocket::SendNextCommand()
Comando:    AUTH SSL
Trace:  CFtpControlSocket::OnReceive()
Risposta:   534 Server is not willing to accept security mechanism
Stato:  Server non sicuro, non supporta FTP su TLS.
Trace:  CFtpControlSocket::SendNextCommand()
Comando:    USER <username>
Trace:  CFtpControlSocket::OnReceive()
Risposta:   331 Send password please.
Trace:  CFtpControlSocket::SendNextCommand()
Comando:    PASS ********
Trace:  CFtpControlSocket::OnReceive()
Risposta:   230 <username> is logged on.  Working directory is "<username>.".
Stato:  Il server non supporta caratteri non ASCII.
Stato:  Accesso effettuato
Trace:  CFtpControlSocket::ResetOperation(0)
Trace:  CControlSocket::ResetOperation(0)
Trace:  CFileZillaEnginePrivate::ResetOperation(0)
Trace:  Measured latency of 195 ms
Stato:  Lettura elenco cartelle...
Trace:  CFtpControlSocket::SendNextCommand()
Trace:  CFtpControlSocket::ChangeDirSend()
Comando:    PWD
Trace:  CFtpControlSocket::OnReceive()
Risposta:   257 "'<username>.'" is working directory.
Trace:  CFtpControlSocket::ResetOperation(0)
Trace:  CControlSocket::ResetOperation(0)
Trace:  CFtpControlSocket::ParseSubcommandResult(0)
Trace:  CFtpControlSocket::ListSubcommandResult()
Trace:    state = 1
Trace:  CFtpControlSocket::SendNextCommand()
Trace:  CFtpControlSocket::TransferSend()
Trace:    state = 1
Comando:    TYPE I
Trace:  CFtpControlSocket::OnReceive()
Risposta:   200 Representation type is Image
Trace:  CFtpControlSocket::TransferParseResponse()
Trace:    code = 2
Trace:    state = 1
Trace:  CFtpControlSocket::SendNextCommand()
Trace:  CFtpControlSocket::TransferSend()
Trace:    state = 2
Comando:    PORT 10,199,168,245,211,254
Trace:  CFtpControlSocket::OnReceive()
Risposta:   200 Port request OK.
Trace:  CFtpControlSocket::TransferParseResponse()
Trace:    code = 2
Trace:    state = 2
Trace:  CFtpControlSocket::SendNextCommand()
Trace:  CFtpControlSocket::TransferSend()
Trace:    state = 4
Comando:    LIST
Errore: Timeout connessione dopo 20 secondi di inattività
Trace:  CControlSocket::DoClose(2050)
Trace:  CFtpControlSocket::ResetOperation(2114)
Trace:  CControlSocket::ResetOperation(2114)
Trace:  CFtpControlSocket::ResetOperation(2114)
Trace:  CControlSocket::ResetOperation(2114)
Errore: Non è stato possibile leggere il contenuto della cartella
Trace:  CFileZillaEnginePrivate::ResetOperation(2114)

更新 2 新的firewalld 配置（ftp 服务器上没有端口被动范围）

public (active)
  target: ACCEPT
  icmp-block-inversion: no
  interfaces: ens192
  sources:
  services: ssh dhcpv6-client ftp
  ports: 20023/tcp 29000-29100/tcp 20021/tcp 21/tcp 30000-65535/tcp
  protocols:
  masquerade: yes
  forward-ports: port=20023:proto=tcp:toport=23:toaddr=10.1.1.2
        port=29000-29100:proto=tcp:toport=29000-29100:toaddr=10.1.1.2
        port=20021:proto=tcp:toport=21:toaddr=10.1.1.2
        port=21:proto=tcp:toport=21:toaddr=10.1.1.2
        port=30000-65535:proto=tcp:toport=30000-65535:toaddr=10.1.1.2
  source-ports:
  icmp-blocks:
  rich rules:

filezilla 调试日志

Comando:    PORT 10,199,168,245,209,41
Trace:  CFtpControlSocket::OnReceive()
Risposta:   200 Port request OK.
Trace:  CFtpControlSocket::TransferParseResponse()
Trace:    code = 2
Trace:    state = 2
Trace:  CFtpControlSocket::SendNextCommand()
Trace:  CFtpControlSocket::TransferSend()
Trace:    state = 4
Comando:    LIST
Errore: Timeout connessione dopo 20 secondi di inattività
Trace:  CControlSocket::DoClose(2050)
Trace:  CFtpControlSocket::ResetOperation(2114)
Trace:  CControlSocket::ResetOperation(2114)
Trace:  CFtpControlSocket::ResetOperation(2114)
Trace:  CControlSocket::ResetOperation(2114)
Errore: Non è stato possibile leggere il contenuto della cartella
Trace:  CFileZillaEnginePrivate::ResetOperation(2114)

答案1

您的 FTP 服务器正在监听端口 54270（用于此特定传输）：

突击队：端口 10,199,168,245,211,254

（211 <<8 + 254）= 54270

因此肯定不在 29000 – 29100 范围内的端口上。

仔细检查您的服务器配置。

答案2

我明白问题出在哪里了：在我的客户端和主机服务器之间有另一个防火墙，它不知道端口 20021 用于 FTP，并阻止被动数据端口上的连接。如果我使用端口 21，防火墙知道这是一个 ftp 端口，那么一切都会正常。

相关内容