port forwarding with iptables

[boooo radly]

i have setup linux box with redhat 7.2 as a router. it has 2 nics, eth1 is the net nic and eth0 is the lan nic.
im running an ftp on a machine on the lan but i also want it to be available through the net. so i just want to forward the port from the router to the internal machine. and i havent been able to get an iptables rule(s) setup to do it. i also chose to accept connections be default and only drop those connections to specific ports that i choose, rather than close everything and only open those that i chose....
heres what i tried

iptables -t nat -A PREROUTING -p tcp --dport 21 -j DNAT --to-dest 192.168.1.10:21
iptables -A FORWARD -p tcp -i eth1 --dport 21 -d 192.168.1.10 -j ACCEPT

i dont think i should need the second line since i have chosen to accept all connections except those speicified, but i figured it was worth a shot anyway...

anyone have any ideas?

[benoit Bruckert]

Hi,
ftp is a specific protocol, because it's storing in the datas during connection the port on each side to established data tranfer.
the ftp-data (port 20) is also used !!
There's a passive mode which permit to avoid the port in data described bellow.
THe best thing is to authorize to go outside any ports gt 1024, and inside the port 20.
If you need ftp from both side, then you will have to open much more other ports.....
See your deny tcp packets from the log to see all what is needed when you try an ftp session...

hope it will help
Benoit

[boooo radly]

where would i find the logs for my tcp connections? i looked and couldnt find anything....but im not exactly sure what file(s) im looking for...

thanks for the help

[Mark Fenton]

boooo, (kinda cool moniker...)

the log in question would be

/var/log/messages

unless you've set up your iptables to log elsewhere.

It might be instructive to run a packet sniffer (like ethereal) to watch what happens on the interfaces when ftp connections are attempted.

Best Regards,
Mark