Topic: ftp forwarding

[Scott Smith]

Scenario:

Central HP-UX host connected to multiple networks via frame relay. Each network has its own connection to a common remote site. Looks somewhat like this:


HP-UX|---net.1---|remote
HP-UX|---net.2---|remote
HP-UX|---net.3---|remote


There is only one HP-UX system and only one remote system (hard to do character drawings in a proportional editor -- sorry)

HP-UX runs a program on behalf of each company represented by each net.* site. Part of the output of the program is to FTP a set of reports to the remote site. As the remote site address is the same, regardless of the company, the program simply connects using the most economical route through the frame (in this case, the net.a link carries all of the traffic.)

Each net.* site runs an e-smith server. The program on HP-UX can be configured so that each instance has the address of the e-smith server at a specific net.* site, rather than the address of remote. The question is: Can the e-smith server be configured so that ftp traffic coming from HP-UX is forwarded to remote?

The easy answer might be:  The reports could be sent via ftp to the appropriate e-smith server, then forwarded via some cron task or daemon to go to the remote. However, timing (ie, real-time response) is critical, so a scheduled relay is not an option, even if it were a short interval such as 60 seconds.

Can port forwarding or some other mechanism be used to automagically route the ftp traffic to remote, so that the connection from HP-UX is actually to remote instead of e-smith? Anyone ever heard of an "ftp relay" type of program? (Also, I realize ftp is not the most secure, but it's what I'm stuck with on the HP-UX and remote systems -- it can't be changed.)

Just to make it even more interesting, can the process be reversed? If remote wishes to communicate with HP-UX via ftp, but must do so through the company-specific net.* path, can it pass through the same e-smith system to do so?

Hopefully that is clear. If not, let me know, I can try again.

TIA

Scott

[Charlie Brady]

Scott Smith wrote:

> Can port forwarding or some other mechanism be used to
> automagically route the ftp traffic to remote, so that the connection
> from HP-UX is actually to remote instead of  e-smith?

If HPUX is a local address and remote is an internet located address, then ftp connections are transparently forwarded by the IP masquerade feature (there is a special ftp masquerade kernel module installed to handle the peculiarities of the ftp proptocol).

> Just to make it even more interesting, can the process be reversed?

No, the aforementioned peculiarities of the ftp protocol means that you cannot even use TCP port forwarding to allow inbound ftp access to an internal host.

I hope this helps.

Charlie