[Xitami] Talking about FTP

[Chris Olson]

Gunnar Swan wrote:
> 
> Am I hearing you guys say that the client FTP can dictate the ports that the server uses for FTP ?

No.  You keep asking questions about "assigning" ports and PASV "mode". 
PASV is an FTP command - not a mode.

If you'd refer to RFC1579, it would become more clear.  You first need some
knowlege about how FTP works.  Different firewalls are different also as far
as the firewalling rulesets and how they deny or reject packets - you should
refer to your firewall documentation.

It's impossible to try and figure out what ports the FTP server will need to
do it's data transfer and then attempt to open those ports in the firewall
because the firewall would look like a sieve.  That's why the PASV command
is normally by an FTP client to get thru a firewall (causes data to be
transfered on the connection port), however, you must make sure your FTP
server properly implements the PASV command first - some do not.  It also
makes a difference whether or not your FTP server is on a DMZ or a private
network, and whether on not it's IP address is private or public.  With more
advanced firewalls, like Dachstein LEAF, you can do FTP transfers to a
privately addressed server behind the firewall, WITHOUT having to use the
PASV command.  That's one of the reasons I install Dachstein LEAF (Linux
Embedded Appliance Firewall) routers for all my clients.  If you're using
one of the cheap cable/DSL routers that are available commercially for
firewalling a home/small business network, you're pretty much on your own,
as these routers have only very limited port forwarding capability,
extremely limited DMZ support, and the firewalling ruleset is very, very
basic.  This is not a cut and dried issue, as there are many variables with
different FTP server/client/firewall combinations.
-- 
Chris Olson
System Administrator
AST Communications     http://www.astcomm.net
Linux Support          http://linux.astcomm.net