Here's a weird one for everyone. I'll use AskDifferent because my test bed is on a Mac, but I don't know that the underlying issue is specifically Mac.
My Mac is behind a NAT wall. Let's call my interface IP address is 192.168.10.61. By using http://www.ipchicken.com, I find my external, NAT-changed address is something else. Let's call that 169.254.101.20.
I'm going to ftp anonymously to ftp.example.com. I make the connection successfully, and successfully change directories:
[ dafydd@testhost ] $ ftp -dt ftp.example.com Connected to ftp.example.com. 220 "Authorized Use Only" ftp_login: user `<null>' pass `<null>' host `ftp.example.com' Name (ftp.example.com:dafydd): anonymous ---> USER anonymous 331 Guest login ok, send your complete e-mail address as password. Password: ---> PASS XXXX 230 Guest login ok, access restrictions apply. ---> SYST 215 UNIX Type: XXXX Version: XXXX Remote system type is UNIX. Using binary mode to transfer files. ---> FEAT 500 'FEAT': command not understood. features[FEAT_FEAT] = 0 features[FEAT_MDTM] = -1 features[FEAT_MLST] = -1 features[FEAT_REST_STREAM] = -1 features[FEAT_SIZE] = -1 features[FEAT_TVFS] = -1 got localcwd as `/Users/dafydd' ---> PWD 257 "/" is current directory. got remotecwd as `/' ftp> cd outgoing ---> CWD outgoing 250 CWD command successful. ---> PWD 257 "/outgoing" is current directory. got remotecwd as `/outgoing'
All good so far, right? Here's the file transfer:
ftp> get testfile.txt local: testfile.txt remote: testfile.txt ---> TYPE I 200 Type set to I. ---> SIZE testfile.txt 213 1024000 ---> EPSV 229 Extended Passive Mode Entered (|||56257|) 229 Extended Passive Mode Entered (|||56257|) ftp: Can't connect to `188.8.131.52': Operation timed out ---> EPRT |1|192.168.10.61|58531| 200 PORT command successful. 200 PORT command successful. ---> RETR testfile.txt 150 Opening BINARY mode data connection for testfile.txt (1024000 bytes). ftp: Poll timeout waiting before accept 421 Service not available, remote server has closed connection. 421 Service not available, remote server has closed connection. ftp> quit
So, I give the
get command. Passive mode times out because the firewall at the far end never opened port 56257 for me. Active mode fails because I'm behind a NAT wall.(*) Everything here is understood, right?
So, how can entering
ftp://ftp.example.com/outgoing/testfile.txt in Firefox succeed from the same host across the same network connections?!
I suppose my serious technical question could be "Can I/How do I see what Firefox is doing under the covers to make this connection work?" Is Firefox bright enough to substitute the NAT IP address in its EPRT/PORT command?
(*) Why does the NAT wall block Active connections? Because I told the ftp server to make its active connection to 192.168.10.61. It can't do that; any route it might have to that IP address won't get to me. The FTP server needs to make its connection to 169.254.101.20. If the NAT box at my end is super smart, it might reach into my EPRT packet and change that IP address to 169.254.101.20. (Which raises all sorts of uncomfortable questions about firewalls modifying packet payloads. Yah, that'll never be subject to cracking...)