Go round IP masquerading ?

SDelroen · 04-01-2009, 12:23 AM

Hi,

I've set up an FTPS server behind a router. I'm using passive mode on data ports 49000-49999.

The following ports are NAT'd by the router: 21, 990, 49000-49999.

I can connect to my server in implicit or explicit mode from inside the network.

From the outside, I can connect to my server in implicit mode but not in explicit mode.

According to this document, it means only one thing: IP masquerading (or NAPT) is screwing my negotiation packages.

The routeur is a Planex BRC-Z14VG-BT [pdf]. It indeed does IP masquerading, and there's apparently no way to disable it in the firmware.

Is there any way to neutralize or go round this IP masquerading ?

**Jason09** · 04-01-2009, 11:25 AM

To connect from outside your network, you will need to use your public IP, which is the external IP listed at www.portforward.com.

SDelroen · 04-01-2009, 07:12 PM

As I explained in my first post, I already connect from the outside, using my public IP, and I have forced the passive mode, and told the server to use a special port range, that I have NAT'd on my router (plus of course 21 and 990).

The problem is, if I encrypt the communication from the very beginning (implicit mode), no problem, but if I try to use negotiation of the cipher between the server and the client (explicit mode), the router can read the packages from the client, and apparently messes them up.

Moreover, portforward.com shows your public IP, but if you don't ask your ISP for a fixed IP, it's mostlikely that your IP will change sooner or later.

04-01-2009, 12:23 AM	#1 (permalink)
SDelroen Registered User Join Date: Mar 2009 Posts: 2 OS: Windows Server 2003 SP2	Go round IP masquerading ? Hi, I've set up an FTPS server behind a router. I'm using passive mode on data ports 49000-49999. The following ports are NAT'd by the router: 21, 990, 49000-49999. I can connect to my server in implicit or explicit mode from inside the network. From the outside, I can connect to my server in implicit mode but not in explicit mode. According to this document, it means only one thing: IP masquerading (or NAPT) is screwing my negotiation packages. The routeur is a Planex BRC-Z14VG-BT [pdf]. It indeed does IP masquerading, and there's apparently no way to disable it in the firmware. Is there any way to neutralize or go round this IP masquerading ?

04-01-2009, 11:25 AM	#2 (permalink)
Jason09 Moderator, Games Team Join Date: Jan 2009 Location: Near Washington, D.C. Posts: 2,353 OS: Windows XP Home Edition Service Pack 3 My System	Re: Go round IP masquerading ? To connect from outside your network, you will need to use your public IP, which is the external IP listed at www.portforward.com. __________________ Gaming troubleshooting steps. Real peace cannot be found in what happens in Washington, D.C. Only God can give true peace to people.

04-01-2009, 07:12 PM	#3 (permalink)
SDelroen Registered User Join Date: Mar 2009 Posts: 2 OS: Windows Server 2003 SP2	Re: Go round IP masquerading ? As I explained in my first post, I already connect from the outside, using my public IP, and I have forced the passive mode, and told the server to use a special port range, that I have NAT'd on my router (plus of course 21 and 990). The problem is, if I encrypt the communication from the very beginning (implicit mode), no problem, but if I try to use negotiation of the cipher between the server and the client (explicit mode), the router can read the packages from the client, and apparently messes them up. Moreover, portforward.com shows your public IP, but if you don't ask your ISP for a fixed IP, it's mostlikely that your IP will change sooner or later.