Use the EPSV port without an embedded address
04A normal EPSV response leaves two endpoint fields blank. Reuse the control connection’s server address and network protocol, with the returned data port.
In the negative alternative a firewall rejects the data connection. The same syntactically valid EPSV reply does not override that policy.
Key idea: No payload address needs rewriting, but the data path still needs a usable mapping and policy.
Terms
- FTP
- File Transfer Protocol. Its control connection carries commands; a separate data connection carries a file or directory listing.
- Client / server
- The client sends FTP commands. Which side opens the data TCP connection is a separate choice.
- Address family
- The network protocol number: 1 for IPv4 and 2 for IPv6 in these examples.
- Passive mode
- The server listens for a data TCP connection that the connecting peer opens.
Rules & examples
No payload address needs rewriting, but the data path still needs a usable mapping and policy.
- A successful extended passive-mode response MUST use 229 and the parenthesized form (<d><d><d><tcp-port><d>). The first two fields MUST be blank; the third is the decimal listening port.
- For EPSV without an argument, data uses the control connection’s network protocol and server network address. In this IPv4 example, control to 203.0.113.20:21 plus returned port 6446 gives data destination 203.0.113.20:6446.
- RFC 2428 §4 explains that EPSV avoids rewriting a network address embedded in FTP command/response payload. Ordinary packet-address translation, appropriate data-port mapping and firewall policy can still be needed.
- The illustrated NAT mapping preserves port 6446 by assumption and translates the outside address to 192.168.1.20. A readable 229 reply does not create that mapping or guarantee data delivery. The blocked alternative stops before the data connection.
- An explicit EPSV protocol request in proxy FTP is a separate case. Do not infer a different-family address from an ordinary 229 response; this response contains no such address.
Documentation addresses and chosen listening ports. Each chapter is a separate bounded example; FTP authentication, authorization, file commands and transfer replies are not a complete FTP implementation here. EPRT/EPSV provide no encryption or guaranteed reachability.
Sources
New to this? Start hereA quick picture + helpful background
Commands arrange a separate file connection
Imagine arranging a delivery by phone, then opening a separate delivery entrance. EPSV asks the server to listen; EPRT can describe another receiving endpoint in a proxy setup. The analogy separates arranging a connection from moving the file and does not promise access through a firewall.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.