Active and passive FTP
Passive FTP
See how PASV lets the client open both control and data connections to the server.
8 minute lesson
With PASV, the server listens on a temporary data port and returns the address and port in a 227 reply. The client opens the data connection there.
Because the client initiates both connections, passive mode usually works better through client-side NAT and firewalls.
The server firewall must permit its configured passive port range, and the advertised address must be reachable by the client. A bad advertised private address is a classic failure.
A classic passive reply carries six numbers:
C: PASV
S: 227 Entering Passive Mode (203,0,113,10,195,81)The client connects to 203.0.113.10 on port 195 * 256 + 81, or 50001. It opens that data connection before or around the following transfer command, depending on the client flow.
NAT must map the advertised public endpoint to the server. The FTP service should use a narrow configured passive range so firewall rules remain predictable.
Some clients ignore an unsafe address in 227 and reuse the control connection’s peer address. Do not depend on that repair. Configure the server to advertise the right public address, or prefer EPSV, which returns only a port.
Decode the reply above by hand. Then compare the address with the control connection peer and decide whether a remote Internet client can reach it.
Lesson completed