3.5. Configuring FTP
3.5.1. How FTP Works
- Active Connections
- When an active connection is established, the server opens a data connection to the client from port 20 to a high range port on the client machine. All data from the server is then passed over this connection.
- Passive Connections
- When a passive connection is established, the client asks the FTP server to establish a passive connection port, which can be on any port higher than 10,000. The server then binds to this high-numbered port for this particular session and relays that port number back to the client. The client then opens the newly bound port for the data connection. Each data request the client makes results in a separate data connection. Most modern FTP clients attempt to establish a passive connection when requesting data from servers.
3.5.2. How This Affects Load Balancer Add-On Routing
ip_vs_ftpkernel module loaded, which you can do by running the command
modprobe ip_vs_ftpas an administrative user at a shell prompt.
3.5.3. Creating Network Packet Filter Rules
iptablesrules for FTP service, review the information in Section 3.4.1, “Assigning Firewall Marks” concerning multi-port services and techniques for checking the existing network packet filtering rules.
21in the Firewall Mark field. See Section 4.6.1, “The VIRTUAL SERVER Subsection” for details.
18.104.22.168. Rules for Active Connections
iptablescommand allows the LVS router to accept outgoing connections from the real servers that IPVS does not know about:
/sbin/iptables -t nat -A POSTROUTING -p tcp -s n.n.n.0/24 --sport 20 -j MASQUERADE
iptablescommand, n.n.n should be replaced with the first three values for the floating IP for the NAT interface's internal network interface defined in the GLOBAL SETTINGS panel of the Piranha Configuration Tool.
22.214.171.124. Rules for Passive Connections
pasv_addressto override the real FTP server address should not be used since it is updated to the virtual IP address by LVS.
10000:20000in the commands below to
iptablescommands have the net effect of assigning any traffic addressed to the floating IP on the appropriate ports a firewall mark of 21, which is in turn recognized by IPVS and forwarded appropriately:
/sbin/iptables -t mangle -A PREROUTING -p tcp -d n.n.n.n/32 --dport 21 -j MARK --set-mark 21
/sbin/iptables -t mangle -A PREROUTING -p tcp -d n.n.n.n/32 --dport 10000:20000 -j MARK --set-mark 21
iptablescommands, n.n.n.n should be replaced with the floating IP for the FTP virtual server defined in the VIRTUAL SERVER subsection of the Piranha Configuration Tool.