TCP/IP Tutorial and Technical Overview - IBM Redbooks

In normal mode, the FTP client first connects to the FTP server port 21 to
establish a control connection. When data transfer is required (for example, as
the result of a DIR, GET, or PUT command), the client sends a PORT command
to the server instructing the server to establish a data connection from the
server's data port (port 20) to a specified ephemeral port number on the client
host.
In an FTP proxy server situation, normal mode means that we have to allow
inbound TCP connections from the non-secure network to the FTP proxy host.
Notice in Figure 22-16 how a connection is established from the FTP server
port 20 in the non-secure network to the FTP proxy server's ephemeral port
number. To allow this to happen, IP filtering rules are used that allow inbound
connection requests from port 20 to an ephemeral port number on the FTP proxy
host. This is normally not an IP filter rule. It is sometimes better to add a custom
filter rule configuration, because it would allow a cracker to run a program on
port 20 and scan all the port numbers above 1023, which, in its simplest form,
might result in a denial-of-service situation. Some firewalls handle this correctly
by building a table of outgoing FTP requests and matching up the corresponding
incoming data transfer request.
FTP
client
epn: Ephemeral port number n
Figure 22-16 Normal mode FTP proxy
802 TCP/IP Tutorial and Technical Overview
Client host FTP proxy server host
Proxy Server
FTP proxy
ep1 21 ep2
21
Incoming
ep4 20 ep3
20
Secure
network
Non-secure
network
Server host
FTP
server