I have some basic questions about FTP with firewalls and NAT, I hope someone could help me :)
I split them up in different scenarios:
Active FTP without NAT
Server 188.8.131.52, Default ports; Client 184.108.40.206, ports: 3141 (cmd), 3142 (data)
Client:3141 connects to Server:20
Server:20 responses to Client:3141
Server:21 connects to Client:3142
How is this usually solved in practice? I can think of following possibilities:
- Client firewall remember that there was a FTP command connection and therefore opens port 3142
- Client firewall remember that there was a FTP command connection and therefore allows all connections from 220.127.116.11:21 to 18.104.22.168:3142
- Client firewall allows all connections from x.x.x.x:21 to 22.214.171.124:3142
I assumed in all these solutions, that the client will always use two consecutive ports - is this true?
Active FTP with NAT
Server 126.96.36.199 default ports; Client 192.168.0.2, ports 3141, 3142; Router, 188.8.131.52 and 192.168.0.1
Client:3141 connects to 184.108.40.206:20 via 192.168.0.1
Server:20 responses to 220.127.116.11:ARBITRARY - is delivered to 192.168.0.2:3141 since there is SNAT
Server:21 connects to 18.104.22.168:(ARBITRARY+1) - from where does the router knows to whom this packet belongs to?
Passive FTP with NAT
Server is behind Router - from where does the router know, that the packet receiving on an arbitrary port is for the FTP Server? (and therefore, how does the router know not to drop this packet)
And why is Passive FTP using an arbitrary port on server site for the data connection? Why not port 21?
I hope you understand my questions and someone can help me :)