Re: [hylafax-users] Connect to Hylafax on privat IP from the Internet

[Bodo Meissner <bodo@xxxxxxxxx>]

Am 12.06.2006 10:34:43 schrieb(en) Bojan Stojanovic:

> You "should" disable your firewall to server or if you have public IP
> on your client you should disable "passive FTP".

Hello Klaus,

Hylafax protocol is similar to FTP.

When not using passive mode, your client, e.g. WHFC specifies an  
address and port on it's side and the HylaFAX server (FTP server) must  
be able to connect to this port.
If your client uses a public IP address, there should not be any  
problems on the client's side. Otherwise you must use masquerading with  
FTP connection tracking on the client's side. I don't know if you have  
to specify HylaFAX' port number to the FTP connection tracking module.

With passive mode you need FTP connection tracking on the server's side  
because your server specifies a port number

> If You use passive FTP on WHFC then you must open wide port range on
> server firewall since passive FTP requires secondary connection on
> some radnom port range on server side...

And you need FTP connection tracking on the server side firewall to  
modify address and port number in the FTP reply and NAT the incomming  
connection to your internal IP address.

> If you use active FTP on
> other hand, only thing that you need to do is to allow all traffic  
> from server's IP on client's firewall.

And the firewall on the server's side must masquerade these connections.

> On Mon, 2006-06-12 at 10:24 +0200, Klaus Rörig wrote:
> > WHCF finds the server, asks for a password an then hangs.
> > After some time it says "Cannot connect to 192.168.51.30", wich is
> > the internal IP of my server. How do I configure Hylafax to  
> replay > with my external IP?

Changing the IP address in the response is not enough. Your firewall  
must open a port which will be forwarded to the HylaFAX server's port.  
This is the purpose of FTP connection tracking.


Bodo

____________________ HylaFAX(tm) Users Mailing List _______________________
 To subscribe/unsubscribe, click http://lists.hylafax.org/cgi-bin/lsg2.cgi
On UNIX: mail -s unsubscribe hylafax-users-request@xxxxxxxxxxx < /dev/null
 *To learn about commercial HylaFAX(tm) support, mail sales@xxxxxxxxx*