0

my original question: FTP client/server failing on switching to PASV mode

Based on that, I would like to know if/how I can open a FTP connection from a computer that is inside a ISP's network that uses Dual-Stack Lite to a FTP server that is only reachable via IPv4.

Obviously, passive FTP doesn't work, but would active FTP work (if I added port-forwarding on the owner's router)?

Improve this question

3 Answers 3

Reset to default
3

Dual-Stack Lite is a NAT solution. Active mode requires, that the client is directly reachable by the server (e.g. no address translation in between), so it will not work if the client is behind any kind of NAT. Passive mode requires that the server is directly reachable by the client and thus does not work if the server is behind NAT.

Worse, if both sides are behind NAT FTP will not work at all, unless these NAT solutions include helpers which rewrite FTP traffic. A workaround would be to use a protocol which does not use any dynamic ports (like ssh/scp/sftp) or have a VPN between the local and the FTP servers network so that they can reach each other without NAT.

Simple port forwarding might work if you can restrict the range of allocated ports used by the client (active mode) or server (passive mode) and have port forwarding established for the complete range. Additionally client (active mode) or server (passive mode) must not send there own IP address inside the PORT command or response to PASV, but the public IP address visible by the peer. If and how all these can be configured at client/server side depends on the specific client/server.

Improve this answer
8
  • 1
    but the FTP server isn't behind a NAT. Does that mean that, in theory, passive mode should work? Or, more clearly, that the package drop in my first question is a side-effect and not directly caused by DS-Lite?
    – Steffen Winkler
    Jul 2, 2014 at 8:13
  • 1
    If the server is not behind NAT, e.g has a public IPv4 address reachable by the client, passive mode should work - unless there is a firewall in between which blocks access to the ports which got dynamically allocated on the server side.
    – Steffen Ullrich
    Jul 2, 2014 at 8:18
  • According to the other post the FTP server is reachable by IPv6 too. Because with Dual-Stack Lite you should have a public IPv6 address please try to reach the server by using its IPv6 address, not IPv4.
    – Steffen Ullrich
    Jul 2, 2014 at 8:24
  • erh, no the server has definetly no IPv6 address. I'll read through my other question, maybe I wrote unclearly somewhere.
    – Steffen Winkler
    Jul 2, 2014 at 8:28
  • 1
    Like I said, there might be an FTP helper involved which can not deal with this situation. These FTP helpers often work at packet level, e.g look for packets with "227 ..." and try to change the contents before forwarding the packet. In this case the helper might be confused because because of the network topology and is not able to rewrite the packet, and will just drop it. I don't know if this is the case, but it would explain what you see at the TCP level. This helper is only used with FTP connections (e.g. to port 21), so anything else including ping is not affected.
    – Steffen Ullrich
    Jul 2, 2014 at 9:48
0

There is a solution to connect to a home network even with dual stack lite using a raspberry pi and the german service feste-ip.net. Please read the (german) blog entry on my webpage if you want to learn how to do it.

Improve this answer
0

Assuming you mean the server is on the public IPv4 internet and the client is behind DS-Lite.

Passive mode will work fine. The client can connect to any port on the server.

Active mode will only work if the NAT in the AFTR is aware of FTP and makes special provisions for it.

This is no conceptually no different from traditional NAT44. However practically DS-Lite is very new while NAT44 has been arround for many years. So it may be harder to find a AFTR implementation that understands and translates active FTP than it is to find a NAT44 implementation that understands and translates active FTP.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .