Why FTP Fails Behind Firewalls and NAT
Imagine you want to download a file from a server using File Transfer Protocol.
FTP is simply a way for your computer (client) to talk to another computer (server) and transfer files. But unlike most protocols, FTP uses two separate connections, and understanding these two connections is the key to everything.
When your computer first connects to the server, it opens something called a control connection. This is like a conversation channel. It always goes to port 21 on the server.
So the connection looks like this:
Client → Server : Port 21
Over this connection, your computer sends commands like:
USER (username)
PASS (password)
LIST (show files)
RETR (download file)
If you capture this in Wireshark, you can literally read these commands in plain text.
But this connection is only for talking. When it’s time to actually transfer a file, FTP opens a second connection, called the data connection.
Now before we go further, there is one concept you must clearly understand: every connection in networking is identified by an IP address and a port together.
Think of it like this: the IP address is the building address, and the port is the room number inside that building. Without both, you cannot deliver the data correctly.
Now here’s something unique about FTP. It does not send port numbers directly like 50000. Instead, it splits the port into two numbers.
For example, you might see this:
PORT 192,168,1,10,195,80
The first four numbers are the IP address: 192.168.1.10.
The last two numbers represent the port, but in a special format. To get the real port, you calculate:
port = (195 × 256) + 80 = 50000
So this line actually means:
“Connect to 192.168.1.10 on port 50000.”
This detail is extremely important because this is exactly what the server will try to do.
Now let’s understand Active FTP.
In Active FTP, after you log in and request a file, your computer sends this PORT command. It is basically telling the server:
“I’m ready. You connect back to me on this IP and port and send the file.”
So your computer is saying, “Call me.”
After receiving this, the server creates the data connection. It always uses its own port 20 and connects to the IP and port you gave.
So the full flow looks like this:
Control connection:
Client → Server (port 21)
Data connection:
Server (port 20) → Client (port 50000)
In a simple network, this works perfectly.
But now let’s bring in the real world.
Most computers today are behind a router. Inside your home network, your computer has a private IP like 192.168.1.10. But this IP is not visible on the internet. The outside world only sees your router’s public IP.
So when your computer sends:
PORT 192,168,1,10,195,80
it is telling the server:
“Connect to 192.168.1.10:50000”
Now the server tries to do that. But from the internet, that address doesn’t exist. It’s a private IP. So the server’s connection attempt never reaches your computer.
If you look at this in Wireshark, you’ll see the server trying to connect (sending SYN packets), but there is no proper response. Eventually, the connection fails.
That’s why Active FTP usually fails in modern networks.
Now you might ask, “Can we still make Active FTP work?”
Yes, but it requires extra setup.
Sometimes routers are smart enough to detect FTP traffic. They can read the PORT command, replace the private IP with the public IP, and open the required port. This is called FTP ALG. But it’s not always reliable.
Another option is manual configuration. FTP clients like FileZilla allow you to specify your public IP, so instead of sending the private IP, your computer sends the correct public IP.
But even then, you must configure your router to forward that port to your computer. This is called port forwarding.
Because all of this is complicated, a better method was introduced: Passive FTP
Now let’s understand Passive FTP, and this is where the missing piece you mentioned comes in—the PASV command.
In Passive FTP, instead of telling the server “connect to me,” your computer sends:
PASV
This means:
“I don’t want you to connect to me. You tell me where I should connect.”
Now the server responds with something like:
227 Entering Passive Mode (203,0,113,5,82,45)
Just like before, the IP is 203.0.113.5, and the port is calculated as:
port = (82 × 256) + 45 = 21037
So the server is saying:
“Connect to 203.0.113.5:21037”
Now your computer initiates the data connection.
So the full flow becomes:
Control connection:
Client → Server (port 21)
Data connection:
Client → Server (port 21037)
Now both connections are started by your computer.
This completely solves the problem.
Because your computer is making an outgoing connection, your router allows it. NAT does not block outgoing traffic, so everything works smoothly.
If you step back and compare both:
#networking #ftp #activeftp #passiveftp #filetransferprotocol #filetransfer #transferringfiles #networksecurity #ccna