Sietse van Zanen wrote :
BZZZZZZZZT
Huh ?
You have just missed the 1.000.000 dollar question. The short answer is indeed: NO.
When you do pure 1:1 NAT and don't filter any traffic, you do not need
to track connections, as any packet will just get NATted between the two
addresses.
Packets will. But addresses in PORT commands or PASV replies won't. So
when the sender of this information is masqueraded, the other side will
try (and mostly fail) to connect to the given private address or simply
refuse to connect because it does not match the apparent address
(protection against abuse).
Possible workaround in passive mode : use the command EPSV instead of
PASV, because unlike the PASV reply, the EPSV reply does not contain the
(useless because already known) server address.
Limit : it works only for a masqueraded server, but the use of EPSV is
up to the client, and not all FTP clients support it.
I repeat, FTP will work without tracking control connections nor special
setup on the NATed host only in the following conditions :
- active mode with a non NATed client, so PORT commands contain the
expected address (the server may be NATed) ;
- passive mode with a non NATed server, so PASV replies contain the
expected address (the client may be NATed) ;
- passive mode with a NATed server when the client uses EPSV (client may
also be NATed) ;
