I checked a similar port forwarding rule in my router (web port 1025 to NAS port 21) and it didn't work for me neither. So I tried something and got a result:
You have to forward TWO ports: The FTP server doesn't respond on port 21, it uses port 22 for the reply.
So your port forwarding rule must be like this:
-WAN Ports- 1025-1026 -to- your NAS IP or device -ports- 21-22 .
So your FTP client calls at port 1025 (waiting for a reply on port 1026) -> your router converts to port 21 -> your ftp server replies on port 22 -> your router converts to port 1026 -> your ftp client gets his response.
A check with http://www.canyouseeme.org/ successed.
//HSishi
You have an incorrect understanding of both how ftp works, and why port forwarding is required - I have been running ftp servers for the past decade with just port 21 forwarded - port forwarding of port 22 is NOT required under any circumstances, and I have run the DNS-323's ftp server with just port 21 forwarded.
Port forwarding first - when a single public IP address is shared using a NAT router, the norm is to allow all outgoing connections, and block all incoming connections,
unless these connections correspond to a previous outgoing connection in which case the NAT router will forward the traffic to the host from which the request originated. Any incoming connection without a corresponding outgoing connection is discarded because the router does not what to do with it. Unsolicited incoming connections can be allowed through, provided the router is told where to send it - for a connection on port a, forward the request to ip address 1.2.3.4 - a process commonly known as port forwarding.
Port forwarding is ONLY required for incoming connections - NEVER for outgoing ones.
With an ftp server running traditional or active ftp on the default port 21, the incoming connection to the server is made on port 21, and if the ftp server is behind a NAT router, the router MUST be told which host the connection is to be forwarded, otherwise it will be discarded - the ftp server then establishes an outgoing data connection - since this connection is outgoing, no port forwarding is required.
In this specific case - where passive ftp has been configured - port 22 would not be used, if he were using the default port 21, and port 1026 will not be used when he uses the non standard port 1025 - when passive ftp is used, the user configures the ports on which the data connection will be made, and those port are required to be forwarded.
For what it's worth - I have also - for the purpose of particular exercise - configured and successfully accessed the ftp server on my DNS-323 on port 1025, without forwarding 1026.
Author
Topic: Can FTP from within my lan via IP but can not access FTP server outside my lan ? (Read 24116 times)