Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

Here's a weird one for everyone. I'll use AskDifferent because my test bed is on a Mac, but I don't know that the underlying issue is specifically Mac.

My Mac is behind a NAT wall. Let's call my interface IP address is By using http://www.ipchicken.com, I find my external, NAT-changed address is something else. Let's call that

I'm going to ftp anonymously to ftp.example.com. I make the connection successfully, and successfully change directories:

[ dafydd@testhost ] $ ftp -dt ftp.example.com
Connected to ftp.example.com.
220 "Authorized Use Only"
ftp_login: user `<null>' pass `<null>' host `ftp.example.com'
Name (ftp.example.com:dafydd): anonymous
---> USER anonymous
331 Guest login ok, send your complete e-mail address as password.
230 Guest login ok, access restrictions apply.
---> SYST
215 UNIX Type: XXXX Version: XXXX
Remote system type is UNIX.
Using binary mode to transfer files.
---> FEAT
500 'FEAT': command not understood.
features[FEAT_FEAT] = 0
features[FEAT_MDTM] = -1
features[FEAT_MLST] = -1
features[FEAT_REST_STREAM] = -1
features[FEAT_SIZE] = -1
features[FEAT_TVFS] = -1
got localcwd as `/Users/dafydd'
---> PWD
257 "/" is current directory.
got remotecwd as `/'
ftp> cd outgoing
---> CWD outgoing
250 CWD command successful.
---> PWD
257 "/outgoing" is current directory.
got remotecwd as `/outgoing'

All good so far, right? Here's the file transfer:

ftp> get testfile.txt
local: testfile.txt remote: testfile.txt
---> TYPE I
200 Type set to I.
---> SIZE testfile.txt
213 1024000
---> EPSV
229 Extended Passive Mode Entered (|||56257|)
229 Extended Passive Mode Entered (|||56257|)
ftp: Can't connect to `': Operation timed out
---> EPRT |1||58531|
200 PORT command successful.
200 PORT command successful.
---> RETR testfile.txt
150 Opening BINARY mode data connection for testfile.txt (1024000 bytes).
ftp: Poll timeout waiting before accept
421 Service not available, remote server has closed connection.
421 Service not available, remote server has closed connection.
ftp> quit

So, I give the get command. Passive mode times out because the firewall at the far end never opened port 56257 for me. Active mode fails because I'm behind a NAT wall.(*) Everything here is understood, right?

So, how can entering ftp://ftp.example.com/outgoing/testfile.txt in Firefox succeed from the same host across the same network connections?!

I suppose my serious technical question could be "Can I/How do I see what Firefox is doing under the covers to make this connection work?" Is Firefox bright enough to substitute the NAT IP address in its EPRT/PORT command?

Any ideas?

(*) Why does the NAT wall block Active connections? Because I told the ftp server to make its active connection to It can't do that; any route it might have to that IP address won't get to me. The FTP server needs to make its connection to If the NAT box at my end is super smart, it might reach into my EPRT packet and change that IP address to (Which raises all sorts of uncomfortable questions about firewalls modifying packet payloads. Yah, that'll never be subject to cracking...)

share|improve this question
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.