FTP的主动与被动模式

转载

mob60475705a319 2009-10-23 11:43:00

It is often a challenge to setup firewall rules for FTP server to work correctly. The root cause for this challenge lies in the FTP protocol architecture.

Each FTP client requires 2 connections to be maintained between client and server.

FTP commands are transferred over connection called control channel. That is the one that typically connects to well known FTP port 21.

Any data transfer, such as directory listing, upload and download happen on secondary connection called data channel.

1.主动模式即PORT模式是ftp client 开启一个端口，然后发送port命令，server收到指令后，主动发起连接，去连接client!

简而言之是客户端开端口，服务器端去连接。这样的话服务器端一般不容易通过客户端前面的防火墙。

2.被动模式即PASV模式。是ftp server端开启一个端口，发送pasv到client，然后由client 主动去连接自己！

简而言之是服务器端开端口，客户端去连接。一般客户端都有防火墙，PASV模式使得客户端容易通过防火墙。

Pasv 相对Port来说就多了一次交互,可能会影响性能!

Windows Firewall Protocols

Windows Firewall provides the stateful filtering of TCP/IP traffic (IPv4 and IPv6) that uses the TCP transport protocol. It also provides the “pseudo-stateful” filtering of TCP/IP traffic that uses the UDP transport protocol. ICMP traffic is not statefully filtered; rather, ICMP traffic is allowed or blocked based on Windows Firewall settings (for example, you can explicitly allow or deny incoming echo requests or outgoing destination unreachable messages by configuring Windows Firewall settings). Because Windows Firewall is tied directly to the TCP/IP architecture of Windows, it does not provide any filtering of non-TCP/IP protocols, such as IPX/SPX or AppleTalk.

With the exception of some File Transfer Protocol (FTP) traffic, Windows Firewall does not use Application layer information to statefully filter traffic. FTP is a special case because of the way in which an FTP server establishes the data channel for an FTP file transfer. During a typical FTP user session, an FTP client initiates a control channel with an FTP server. When the FTP client transfers a file from the FTP server, the FTP server tries to establish a data channel with the FTP client by initiating communication on a TCP port different from the one used for the control channel. This can cause most firewalls running on the FTP client computer to drop the data channel packets coming from the server because they appear to be unsolicited. To overcome this problem, Windows Firewall uses the Application Layer Gateway Service to provide dynamic port mapping for the FTP data channel, thereby facilitating the stateful filtering of FTP traffic.

Passive (PASV) FTP is not treated as a special case and is not handled by the Application Layer Gateway Service. PASV FTP traffic is statefully filtered by Windows Firewall in the same way other TCP/IP traffic is statefully filtered.

Although Windows Firewall does not use Application layer information to statefully filter traffic, Windows Firewall does use Application layer information to identify and manage some traffic.

用windows控制台登陆ftp 服务器后

执行 dir 命令，发现 client 是PORT模式，如下图

FTP的主动与被动模式_ide