Re: Troubleshooting FTP -- MIDRANGE-L

I have a PC based FTP server which is listening on port 21 and have set up
port redirection to accept requests on, say, port 400 and redirect those
through to port 21 on the iSeries.

I wouldn't expect this to work. I'd expect that when trying to do anupload, download, or directory listing, the connection would hang.

My client, however, is unable to connect to the iSeries although he can get
through from his box to the PC based server on port 21.

Are you sure he's unable to "connect"? Is it possible that the problem isoccuring later when he tries to do a file transfer (directory listings arealso file tranfers of a sort).

You see, the FTP protocol doesn't operate on a single port. It startswith port 21, but when you transfer a file it sends (over port 21) a notesaying "connect to me at IP address x.x.x.x on port number pppp) and theother end of the session tries to open a connection to that port on thataddress.

However, when you use a NAT router, the actual IP addresses aren't thesame. You might use 192.168.0.1 on the inside router, and a public IPaddress 1.2.3.4 on the outside of the router. Unfortunately, the FTPserver doesn't know this, and tells the remote host to connect to port XXXon 192.168.0.1 -- which will fail.

NAT machines are smarter than that, though. They actually monitor thetraffic on port 21 -- when they see the FTP software say "connect to192.168.0.1" they change that message to tell it to connect to 1.2.3.4,and therefore it works correctly.

However, if you ran FTP on a nonstandard port (for example 400) itwouldn't know that it had to monitor that port for an IP address beingsent, and therefore wouldn't fix the address. So I'd expect FTP on anyother port besides 21 to fail. (Unless, of course, your router provides away to designate port 400 as an FTP port.)

Back in the olden days before routers were smart enough to monitor port 21traffic and fix it, you could work around the problem by using passivemode (if the server side was behind NAT) or standard mode (if the clientside was behind NAT). You could use this to make port 400 work for you --but it'd only work if they're not BOTH behind a NAT router. If both endsare behind NAT, the router needs to monitor and fix the data, otherwiseit'll fail.