What ports need to be open for the client to use the FTP client software?
FTP is a TCP based service exclusively. There is no UDP
component to FTP. FTP is an unusual service in that it utilizes two
ports, a 'data' port and a 'command' port (also known as the
control port). Traditionally these are port 21 for the command port
and port 20 for the data port. The confusion begins however, when
we find that depending on the mode, the data port is not always on
port 20.
In active mode FTP the client connects from a random
unprivileged port (N > 1023) to the FTP server's command port,
port 21. Then, the client starts listening to port N+1 and sends
the FTP command PORT N+1 to the FTP server. The server will then
connect back to the client's specified data port from its local
data port, which is port 20. From the server-side firewall's
standpoint, to support active mode FTP the following communication
channels need to be opened: * FTP server's port 21 from anywhere
(Client initiates connection) * FTP server's port 21 to ports >
1023 (Server responds to client's control port) * FTP server's port
20 to ports > 1023 (Server initiates data connection to client's
data port) * FTP server's port 20 from ports > 1023 (Client
sends ACKs to server's data port)
In order to resolve the issue of the server initiating the
connection to the client a different method for FTP connections was
developed. This was known as passive mode, or PASV, after the
command used by the client to tell the server it is in passive
mode. In passive mode FTP the client initiates both connections to
the server, solving the problem of firewalls filtering the incoming
data port connection to the client from the server. When opening an
FTP connection, the client opens two random unprivileged ports
locally (N > 1023 and N+1). The first port contacts the server
on port 21, but instead of then issuing a PORT command and allowing
the server to connect back to its data port, the client will issue
the PASV command. The result of this is that the server then opens
a random unprivileged port (P > 1023) and sends the PORT P
command back to the client. The client then initiates the
connection from port N+1 to port P on the server to transfer data.
From the server-side firewall's standpoint, to support passive mode
FTP the following communication channels need to be opened: * FTP
server's port 21 from anywhere (Client initiates connection) * FTP
server's port 21 to ports > 1023 (Server responds to client's
control port) * FTP server's ports > 1023 from anywhere (Client
initiates data connection to random port specified by server) * FTP
server's ports > 1023 to remote ports > 1023 (Server sends
ACKs (and data) to client's data port)