I'm setting up an FTP server with TLS/SSL encryption (FTPS, not SFTP). The server would be placed in DMZ. This means that it has tho interfaces: one for connections from the company's network and the other (statically NATed to Internet-valid ip address on a border router) for connections from the Internet.
A small ASCII-art to illustrate the setup:
|<----------------------------- DMZ --------------------->| Inet <---------> | border router | <-------> FTPS server <-------> Internal network 188.8.131.52 | 184.108.40.206 <NAT> 10.0.1.1 | 10.0.1.1 10.0.2.2
Active mode works well. But for the passive mode, FTP server has to send its IP address to the client. First problem is that the server doesn't know its external address (220.127.116.11), only DMZ-external (10.0.1.1). FTP server software allows to set this address (ForceIpAddress in pure-ftpd), but in this case users from internal network will be unable to work with this FTP (because it will send them 18.104.22.168 instead of 10.0.2.2)
So, the question is if there is a method to choose the IP to send according to client IP address or the interface, the request came to? Note that if a client connects from the Internet, he should get Internet-valid IP address (22.214.171.124) insted of server's internal (10.0.1.1). I'm using pure-ftpd but can change to anything else.
I used two FTP servers on different ports and redirected the request using iptables, but this is not the best way, I think. Some FTP clients (ex. WinSCP) also allow to force the server's address, but not all of them.
Any options to solve the situation?