top button
Flag Notify
    Connect to us
      Site Registration

Site Registration

Why active File Transfer Protocol (FTP) doesn't work with Network Address Translation (NAT) in internet environment?

+1 vote
356 views
Why active File Transfer Protocol (FTP) doesn't work with Network Address Translation (NAT) in internet environment?
posted May 23, 2014 by Simranjeet Singh

Share this question
Facebook Share Button Twitter Share Button LinkedIn Share Button

1 Answer

0 votes

In Active FTP, the data connection is established to a port on the FTP client by the FTP server. The port number along with the IP address to which the server needs to initiate the connection is provided by the FTP client after the control connection is succesfull. When the client is behind the NAT router, the FTP server cannot initiate the connection to the provided IP address , as typically it would be a private IP address not routable on the internet.

answer May 27, 2014 by Amarvansh
Similar Questions
+1 vote

Is there a way to bypass nat ftp helper for a few connections and allow the rest of the FTP connections to NAT with the FTP helper module ?

The need is to NAT the FTP control and data connections without conntrack-helpers .

+1 vote

I have a gateway application which I am using iptables to NAT from a LAN interface to a WAN interface (linux 3.2.6). This mostly works well, except that I sometimes see (via wireshark) IP packets being sent out
the WAN interface that originated from the LAN interface that iptables fails to apply NAT.

These packets seem to usually be FIN, FIN/ACK, or RST packets. I suspect that these are for IP connections from the device connected to the LAN interface that were setup prior to being connected to the
gateway on which I am running iptables. After some time, I think the application on the connected device decides to close these connections (FIN), but iptables fails to NAT these packets. Why?

From the iptables man page:

nat:
This table is consulted when a packet that creates a new connection is encountered. It consists of three built-ins: PREROUTING (for altering packets as soon as they come in), OUTPUT (for altering locally-generated packets before rout-ing), and POSTROUTING (for altering packets as they are about to go out).

I'm concerned about the statement that says, "when a packet that creates a new connection is encountered". Since the SYN packet for the problem FIN,RST packets was not seen by iptables, does this mean that iptables will not NAT the FIN packet? This would seem wrong to me.

+3 votes

Which local IP address does FTP select to connect to remote when it has multiple IP addresses ?

...