Cannot connect to FTP server from external host

Question

I have a FTP server (vsftpd) setuped on a Linux box (Ubuntu server). When I try to connect with a computer on the same network everything works fine as expected.

But as soon the IP is external it won't connect..

I first assumed the port was blocked, but then:

localserver:$ sudo tail -f /var/log/vsftpd.log
Wed Jan 13 14:21:17 2010 [pid 2407] CONNECT: Client "xxx.xxx.107.4"
remotemachine:$ netcat svn-motion.no-ip.biz 21
220 FTP Server

And it hangs there. Do any ports other than 21 need to be open?

Solution

When putting an FTP server behind a NAT, you not only have to forward port 21/TCP to the server, you also need a NAT gateway that has an FTP ALG that supports FTP servers behind the NAT (note: this is a rare feature, and rarely advertised on the box or on the tech specs page or even in the manual), and knows to watch the FTP control data stream for commands from clients that indicate the client wants the FTP server to use passive mode (where the FTP server starts listening for a data TCP connection on another port, sends that port number to the client, and passively waits for the client to initiate data TCP connection to the server). The FTP ALG has to watch for what port the server told the client to connect on, and then automatically create a temporary port forwarding entry to allow that connection to get to the server.

Basically, Passive mode FTP, which is great when the client is behind a NAT, is a big problem when the server is behind the NAT. If it turns out that your client is NOT behind a NAT, then tell your client to use traditional "active" mode FTP, and you don't need to have a sophisticated "server behind the NAT" FTP ALG in your NAT gateway.

Another option would be to make your FTP server be your DMZ host (a.k.a. "default host", "bastion host"). Since all unexpected incoming connection attempts are forwarded to the DMZ, all those passive mode FTP data TCP connections would automatically go do your FTP server.

Comments

[h3.]

sftp does not use multiple connection, it only use 21 and thus is passive by default.

[h3.]

Oh, right.. when using ftp only I get "Unknown server error"

[h3.]

When using the IP directly it works ..