TIS ftp-gw and PASV

[sgcccdc @ citec . qld . gov . au (Colin Campbell)]

Hi,

Have I missed the boat or what? I do not understand what I am seeing.

I am testing ftp-gw and passive ftp in the following config:


	----------+-----------------+-----------------+-------
		  |                 |                 |
		  |                 |                 |
		hosta             hostb             hostc

I run ftp (with passive modifications) to ftp-gw on hostb. A netstat
shows

	hosta.xxxx              hostb.ftp

At the prompt (Name:hostb:blah) I type user @
 hostc .
  The connection gets
established and netstats show:

	hosta.xxxx              hostb.ftp
				hostb.yyyy         hostc.ftp

This I understand and expect. BUT, whenever I do something on hostc,
for example an `ls' what I see is:

    227 Entering Passive Mode (hostc,133,126)
    150 ASCII data connection for /bin/ls (hosta,39096) (0 bytes).

So what netstat shows is:

	hosta.xxxx              hostb.ftp
				hostb.yyyy         hostc.ftp
	hosta.zzzz                                 hostc.wwww

Why is this happening? I fully expected there to be a connection from
hosta.zzzz to hostb.vvvv and hostb.uuuu to hostc.wwww. 

I am testing so I can develop filters for a firewall that looks like this:

			outside
			  |
			router1
			  |
			--+------------+----
			  |            |
			router2      bastion
			  |
			inside

What I am seeing says the firewall must let any connection from the inside
go through without going to the bastion first. Is this correct?

Colin