Member Avatar for coding101

I need help creating a rule to do the following:

Forward my ftp traffic to my virtual machine
I have eth0 as the main IP, and virb0 as a bridge to
the vm at a private ip. Any idea how to forward
ftp traffic to my servers address to the vm?

Example

Server - 192.168.1.1
Bridge - 192.168.100.1
Vm - 192.168.100.5

so will get the ftp data from 192.168.100.5

thanx

  • 2 Contributors
  • 1 Reply
  • 289 Views
  • 3 Days Discussion Span
  • Latest Post Latest Post by Z28James

Dani AI

Generated

Good start — is right that you need DNAT of the FTP control port on the host so connections to the host’s external IP reach the VM. That alone, however, is usually not enough: FTP opens separate data connections (active vs. passive) and the host must forward those too and let the kernel track RELATED connections.

Practical checklist to make it work reliably:

  • Enable IP forwarding on the host.
  • Allow forwarding for ESTABLISHED,RELATED connections and permit new TCP->21 to the VM.
  • Load the FTP connection-tracking helper so the kernel can follow and allow dynamic data channels (module names differ by kernel: try nf_conntrack_ftp, fall back to ip_conntrack_ftp).
  • If you use passive (PASV) mode (recommended behind NAT), configure the FTP server to advertise the host’s external IP and a limited passive port range, and DNAT that passive port range to the VM.

Useful commands (replace placeholders with your addresses):

sysctl -w net.ipv4.ip_forward=1

# load helper (tries modern then legacy name)
modprobe nf_conntrack_ftp || modprobe ip_conntrack_ftp

# forwarding policy examples
VM_IP=<vm_private_ip>
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -p tcp -d $VM_IP --dport 21 -m conntrack --ctstate NEW -j ACCEPT

# DNAT the passive port range advertised by the FTP server
EXT_IP=<external_ip>
iptables -t nat -A PREROUTING -p tcp -d $EXT_IP --dport 30000:30010 -j DNAT --to-destination $VM_IP

Quick troubleshooting: verify net.ipv4.ip_forward, inspect iptables -t nat -L -n -v and iptables -L FORWARD, watch packets with tcpdump on the external interface, and check the server’s PASV reply — if the PASV response contains the VM’s private IP the client won’t connect, so correct the server’s advertised IP or use the conntrack helper + DNAT for the passive range. If complexity is a concern, consider SFTP (port 22) which avoids separate data channels.

Member Avatar for Z28James

Something like this might work:

iptables -t nat -A PREROUTING -p tcp -d 192.168.1.1 --destination-port 21 -j DNAT --to-destination 192.168.100.5:21

This should forward port 21 pointed at 192.168.1.1 and direct it to 192.168.100.5.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.