While stop working active mode FTP after change server port

Question

I'm using proftpd on my server (ubuntu 16.04 x86_64).

Default proftpd use standart 21 port. I can connect from my home notebook to ftp with active mode without problem.

Now I stop proftpd, change port from 21 to 10021, start service again. And now I can not connect with active mode, only with passive mode.

1. What's changed?

2. Also I can not understand, why works active mode? I have internet access by router. I do not forwand any ports to my notebook at router. As I now, on connect, my notebook (ftp client) create connection from some port > 1023 to server port 21. My notebook send to server also second (data) port to server and server connect from own port 20 to me with this data port. But how second connection can established, if my ports are closed from wan?

Answer 1

Your firewall (router) has a connection tracking helper for FTP. When it sees an FTP control connection (which it recognizes by TCP destination port == 21), it watches the commands. When it sees your client send the PORT command, it rewrites it (to your external IP address, and maybe a different port) and keeps track of the expected connection from the FTP server. When that connection arrives, it's allowed through.

When you changed the port, none of that happened, because 10021 isn't recognized as an FTP control connection.

On Linux, at least, that feature is the nf_conntrack_ftp module, and you can set the ports option to include 10021 if desired.

PS: A similar thing can be done with a firewall in front of the server, though in reverse: it's done on passive-mode transfers, instead of active-mode.