A special port type of "FTP" is available in the Dashboard to facilitate the forwarding of FTP connections to your backend server.
Add the FTP control port
Open Services, find your service, and choose Action > Ports. Under Single Port, click Add port manually when Add your first port is shown; otherwise click Add Port. Enter your FTP control port in Port start (normally 21), choose FTP in Protocol, and select Reverse Proxy as Backend method. Enter your Backend address and Backend port, then click Save and check the saved row. For an existing tunnel, choose the available Encapsulated backend method and that tunnel instead.
Passive Transfer Forwarding
The FTP port type forwards passive connections by default.
If your FTP server is behind NAT, configure it to masquerade as your public IP address. This address must match the address supplied to X4B for your backend server. In ProFTPd, use the MasqueradeAddress setting.
For servers using GRE/IPIP tunnels, the masqueraded address must be the internal IP at your end of the tunnel.
Choose a small passive-port range supported by your service and forwarding method. Configure the FTP server and firewall to use the same range. Do not assume that a generic FTP server's high-port defaults are accepted as a manually configured X4B port range.
The FTP port type manages passive data connections separately from ordinary forwarding rules. Confirm the permitted passive range for this mode before deployment; application port restrictions describe ordinary rules. Test a directory listing, upload and download from an external client after configuration.
Active Transfer Forwarding
Active transfer mode is not supported with the Reverse Proxy backend method. Passive mode is the default and preferred method in most clients.
You can usually disable active mode on the FTP server.
For example, add the following to proftpd.conf to disable active mode in ProFTPd:
<Limit PORT>
DenyAll
</Limit>
