如何用haproxy更改内网数据包的发出的ip地址？

Question

内网架设一台ftp服务器，地址192.168.1.11。软路由（网关）用haproxy做反向代理, 配置如下：

frontend ao3-ftp
mode tcp
bind ftp.ao3.com.au:21
bind ftp.ao3.com.au:20
bind ftp.ao3.com.au:5000-5100
default_backend myftp

backend myftp
server server1 192.168.1.11

客户端错误如下：

Status: Connected, waiting for welcome message...
Reply: 220-FileZilla Server version 0.9.41 beta
Reply: 220 Hi welcome to Ao3 ftp Server
Reply: 200 Don't care
Command: USER ingram
Reply: 331 Password required for ingram
Command: PASS ***********
Reply: 230 Logged on
Command: SYST
Reply: 215 UNIX emulated by FileZilla
Command: FEAT
Reply: 211-Features:
Reply: MDTM
Reply: REST STREAM
Reply: SIZE
Reply: MLST type;size;modify*
Reply: MLSD
Reply: UTF8
Reply: CLNT
Reply: MFMT
Reply: 211 End
Command: PWD
Reply: 257 "/" is current directory.
Status: Current path is /
Command: TYPE I
Reply: 200 Type set to I
Command: PASV
Reply: 227 Entering Passive Mode (192,168,1,11,19,144) ---here the problem
Error: Server returned unroutable private IP address in PASV reply

问题发生在倒数第二行 服务器返回passive mode的ip地址和端口，但是这是内网的ip地址，有没有办法把这个ip地址编程外网ip，例如：211.179.0.76
这样用户就可以访问ftp服务器了。

Answer 1

这种情况应该修改ftp server的配置，让它在PASV模式下给出的外网ip，并且在nat路由上做好相应的端口映射/DMZ。