In addition, if the port number specified in the response has not been opened on the firewall or routing device, that would also cause the connection to fail. Since the client does not belong to the internal network, it will naturally fail to connect and eventually time-out. What then happens is that, when the client, in turn, attempts to connect, it will attempt to connect to that internal IP address. So now, when the FTPS server responds to the PASV command, its response will specify the FTPS server’s internal IP address and the port number it will be listening on. We’ll be using the term ‘firewall’ but this kind of situation applies to NAT routers, reverse proxies and other routing devices as well.
The client, which is is outside the internal network, is connecting to the FTPS server via the firewall's external IP address. Basically, the FTPS server is in an internal network and has an internal IP address assigned to it. So, let’s say we have an FTPS server sitting behind a firewall. But once you have a firewall or NAT router in between, things can get pretty messy.
This shouldn’t be a problem for direct connections.
0 kommentar(er)
