ftp bounce attack

alexey

Hi.
Problem with access to remote FTP. Add rule to access to ip of FTP. Have a error in log "NAT ftp bounce attack, victim is 127.0.0.1:52216, action DROP".  What is mean & what to do?
In source ip of local computer, in remote ip of ftp.

jasailafan

The bounce attack occurred when ALG FTP is enabled.

NAT works with ALG FTP, and client must set PASV mode.

                       Enable ALG FTP   DISABLE ALG FTP

PASV                       ok                           fail

ACTIVE                   fail                          fail

When ftp client select Active mode, client selects an IP and port to transfer data.

ZyWALL by default detects bounce attack and drop this packet.

Hence, make sure the ftp client is PASV mode.

Jeremylin

Just curious that the log message will display on USG when your local PC which behind USG try to access FTP?
The FTP bounce attack is an exploit of the FTP protocol. Here is more detail.
http://www.securityfocus.com/advisories/174

alexey

Yes, the error display, when local user try to connect remote ftp. And the connection does not occur.
I did this rule for all lan ip, and part of PC connect, other part falls with subject error.

jasailafan

The bounce attack occurred when ALG FTP is enabled.

NAT works with ALG FTP, and client must set PASV mode.

                       Enable ALG FTP   DISABLE ALG FTP

PASV                       ok                           fail

ACTIVE                   fail                          fail

When ftp client select Active mode, client selects an IP and port to transfer data.

ZyWALL by default detects bounce attack and drop this packet.

Hence, make sure the ftp client is PASV mode.