[Xitami] Talking about FTP

[Gunnar Swan]

Thanks. It's getting clearer. 
It's my clients that I have written (Shockwave) that will FTP to only this server. FTP will not be available to the public.
Since the client can assign the port, and my client software communicates to this server, I can open the port on the firewall.

And I think you have helped.

5/28/02 12:02:34 PM, Chris Olson <chris@astcomm.net> wrote:

>Gunnar Swan wrote:
>> 
>> Am I hearing you guys say that the client FTP can dictate the ports that the server uses for FTP ?
>
>No.  You keep asking questions about "assigning" ports and PASV "mode". 
>PASV is an FTP command - not a mode.
>
>If you'd refer to RFC1579, it would become more clear.  You first need some
>knowlege about how FTP works.  Different firewalls are different also as far
>as the firewalling rulesets and how they deny or reject packets - you should
>refer to your firewall documentation.
>
>It's impossible to try and figure out what ports the FTP server will need to
>do it's data transfer and then attempt to open those ports in the firewall
>because the firewall would look like a sieve.  That's why the PASV command
>is normally by an FTP client to get thru a firewall (causes data to be
>transfered on the connection port), however, you must make sure your FTP
>server properly implements the PASV command first - some do not.  It also
>makes a difference whether or not your FTP server is on a DMZ or a private
>network, and whether on not it's IP address is private or public.  With more
>advanced firewalls, like Dachstein LEAF, you can do FTP transfers to a
>privately addressed server behind the firewall, WITHOUT having to use the
>PASV command.  That's one of the reasons I install Dachstein LEAF (Linux
>Embedded Appliance Firewall) routers for all my clients.  If you're using
>one of the cheap cable/DSL routers that are available commercially for
>firewalling a home/small business network, you're pretty much on your own,
>as these routers have only very limited port forwarding capability,
>extremely limited DMZ support, and the firewalling ruleset is very, very
>basic.  This is not a cut and dried issue, as there are many variables with
>different FTP server/client/firewall combinations.
>-- 
>Chris Olson
>System Administrator
>AST Communications     http://www.astcomm.net
>Linux Support          http://linux.astcomm.net
>
>--
>Xitami Users Mailing List -- For Xitami support
>To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami
>