Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

my original question: FTP client/server failing on switching to PASV mode

Based on that, I would like to know if/how I can open a FTP connection from a computer that is inside a ISP's network that uses Dual-Stack Lite to a FTP server that is only reachable via IPv4.

Obviously, passive FTP doesn't work, but would active FTP work (if I added port-forwarding on the owner's router)?

share|improve this question
up vote 3 down vote accepted

Dual-Stack Lite is a NAT solution. Active mode requires, that the client is directly reachable by the server (e.g. no address translation in between), so it will not work if the client is behind any kind of NAT. Passive mode requires that the server is directly reachable by the client and thus does not work if the server is behind NAT.

Worse, if both sides are behind NAT FTP will not work at all, unless these NAT solutions include helpers which rewrite FTP traffic. A workaround would be to use a protocol which does not use any dynamic ports (like ssh/scp/sftp) or have a VPN between the local and the FTP servers network so that they can reach each other without NAT.

Simple port forwarding might work if you can restrict the range of allocated ports used by the client (active mode) or server (passive mode) and have port forwarding established for the complete range. Additionally client (active mode) or server (passive mode) must not send there own IP address inside the PORT command or response to PASV, but the public IP address visible by the peer. If and how all these can be configured at client/server side depends on the specific client/server.

share|improve this answer
but the FTP server isn't behind a NAT. Does that mean that, in theory, passive mode should work? Or, more clearly, that the package drop in my first question is a side-effect and not directly caused by DS-Lite? – Steffen Winkler Jul 2 '14 at 8:13
If the server is not behind NAT, e.g has a public IPv4 address reachable by the client, passive mode should work - unless there is a firewall in between which blocks access to the ports which got dynamically allocated on the server side. – Steffen Ullrich Jul 2 '14 at 8:18
According to the other post the FTP server is reachable by IPv6 too. Because with Dual-Stack Lite you should have a public IPv6 address please try to reach the server by using its IPv6 address, not IPv4. – Steffen Ullrich Jul 2 '14 at 8:24
erh, no the server has definetly no IPv6 address. I'll read through my other question, maybe I wrote unclearly somewhere. – Steffen Winkler Jul 2 '14 at 8:28
Like I said, there might be an FTP helper involved which can not deal with this situation. These FTP helpers often work at packet level, e.g look for packets with "227 ..." and try to change the contents before forwarding the packet. In this case the helper might be confused because because of the network topology and is not able to rewrite the packet, and will just drop it. I don't know if this is the case, but it would explain what you see at the TCP level. This helper is only used with FTP connections (e.g. to port 21), so anything else including ping is not affected. – Steffen Ullrich Jul 2 '14 at 9:48

There is a solution to connect to a home network even with dual stack lite using a raspberry pi and the german service Please read the (german) blog entry on my webpage if you want to learn how to do it.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.