Set FTP service internal network penetration to external network access

The network communication with SFTP is more complicated, and it requires a control port (21) and a data port (20 by default). Therefore, if you want to provide the FTP service of the internal network to the external network through port mapping, a more complicated strategy is required.

Introduction to FTP service mode:

• Active mode: In active mode, the client will open two ports, N and N+1, where N is the client's command port, and N+1 is the client's data port. By default, the server port 21 is used as the command port, and port 20 is the data port.
• Passive mode: In passive mode, in addition to specifying the command port, you can also specify the lower and upper bounds of the data transmission port range.

Required operation:

• 1. Turn on the passive mode;
• 2. Set pasv_max_port, pasv_min_port, and external network mapping port numbers to the same value;
• ​3. External network mapping port: 21 port, passive mode port;

Configuration file: /etc/vsftpd/vsftpd.conf

pasv_enable=yes （Default: YES ）  设置是否允许pasv模式
pasv_promiscuous=yes （Default: NO ） 是否屏蔽对pasv进行安全检查，（当有安全隧道时可禁用）
pasv_max_port=10036  （Default: 0 (use any port) ） pasv使用的最大端口
pasv_min_port=10036  （Default: 0 (use any port) ） pasv使用的最小端口
pasv_address （Default: (none - the address is taken from the incoming connected socket) ） pasv模式中服务器传回的ip地址