Passive Mode

In passive mode, the server LISTENS on a data port; client connects to it. The server-listens model is more NAT/firewall-friendly.

C → S: PASV
S → C: 227 Entering Passive Mode (10,0,0,1,98,234)   (server's IP, port = 98*256+234 = 25322)
C: [opens TCP connection to 10.0.0.1:25322]
C → S: RETR file.txt
S: 150 ... ; sends data over passive connection
S: 226 ...

Now the client (often behind NAT) initiates outbound to the server. NAT works fine: client's outbound creates mapping; reply arrives.

Server complications:

• Server must allocate a port per data transfer.
• If server is behind NAT/firewall: must announce its EXTERNAL IP and the port must be forwarded.
• Common: server config has pasv_address = <external_ip> and pasv_min_port/pasv_max_port range.

EPSV (extended PASV, RFC 2428):

EPSV
229 Entering Extended Passive Mode (|||25322|)

Just the port. Family + IP same as control connection. IPv6-friendly. Recommended for modern.

Firewall + FTP:

• Stateful firewalls inspect FTP control channel and dynamically open data channel ports.
• iptables nf_conntrack_ftp module does this.
• Works for cleartext FTP. Breaks for FTPS (encrypted).

Encryption + passive:

• FTPS encrypts control channel. Firewall can't see PASV/PORT replies.
• FTPS encrypted data channel via PROT P command.
• Firewalls need explicit configuration of port ranges.

Most modern FTP setups use:

• TLS on control channel.
• Passive data mode.
• Configured PASV port range.

PASV reply IP issue: server behind NAT might announce its INTERNAL IP. Client tries to connect to that IP — fails. Server config must override pasv_address.