What can be the mistake?

Security Firewall Rules
1

Hello, im facing this problem:
dmz → orange → Ubuntu 20.04 with filezilla-server. Ip: 192.168.2.2 and gateway 192.168.2.1
green zone → Windows 10 with filezilla-client. ip 192.168.0.2 and gateway 192.168.0.1

I want to connect from ftp client in green zone with ftp server in orange/dmz.
Im able to ping from green to dmz.
I can ping ( from GREEN):
$ping 192.168.0.2 ( from machine 192.168.0.2)
$ping 192.168.0.1 ( from machine 192.168.0.2)
$ping 192.168.2.1 ( from machine 192.168.0.2)

But i cant reach my objective 192.168.2.2.

I can ping ( from orange):
$ping 192.168.2.2 ( from machine 192.168.2.2)
$ping 192.168.2.1 ( from machine 192.168.2.2)
$ping 192.168.0.1 ( from machine 192.168.2.2)

But as a test i cant reach 192.168.0.2

.Ipfire setup in firewall, rules is default.
Should not be problem of port as other mates with same configuration have reached their objective…

Seems something is wrong inside ipfire, but i cant assure and i dont know what can be the reason

Any ideas would be apreciated
Thanks

2

can you post route from green and route from orange?

3

Can you explain better please ?

4

orange has ubuntu 20.04, there is a command, route, which will show the routing table. You can even use traceroute (or mtr 192.168.0.2) to see the steps taken to reach orange from green.

green is win10, I assume there is a route command from cmd, similar to linux.

5

Thanks for your help… route i assume without any parameters… and traceroute with destination ip similar as ping… am i right ?
Tomorrow ive class with students id answer what you ask for…thanks in advance…

6

According to the firewall policy green → orange is open. But orange → green needs a pinhole. See the wiki how to make a pinhole. Also check that the win10 does not block something from its default firewall.

3 Likes
7

ftp is a bad protocol for testing. In some modes the server open a second connection back to the client and this is blocked by the firewall.

1 Like
8

Sorry for the delay, ive been busy…i finally solved it, dont know exactly how…i restarted all vms and it worked…

That makes me ask ( id open a post not to mix things), that if you are working with different vm, in different zones, should ipfire be the last machine to be started or the first one ? Or it makes no difference ?

Thanks