Question about Passive FTP

Any recent firewall will read/inspect the content of the FTP control connection (Port 21 from client to server) and use the information in the PORT command to dynamically allow the data connection, no matter what port is used nor who opens the data connection (active or passive FTP). In the Linux Netfilter framework this mechanism is called a conntrack helper (connection tracking). Other vendors have their own names for it.

Passive FTP is only 'better', if you have an older firewall, as you can say:

• ALLOW client:* -> server:21 (redundant)
• ALLOW client:* -> server:*

which allows the dynamically chosen port of the FTP server for the data connection without need to inspect the control connection. However, that's not following the 'principle of least privilege' and thus should be avoided.

Why in passive FTP the client opens data connection to a random port specified by the server rather than to port 20?

That's how the FTP protocol is designed. If you want to know why, please contact the authors of the RFC (although J. Postel already died. Don't know about J. Reynolds).

If ,by any chance someone designs passive ftp server which will send port 20 (in PASV) for data connection will the firewall block that incoming syn-ack(Data connection)from server?

If that was the case, you will have to open your firewall for only two ports.

• ALLOW: client:* -> server:21 (control connection)
• ALLOW: client:* -> server:20 (data connection)

But as I said, with any recent firewall you only need this rule

• ALLOW: client:* -> server:21 (control connection)

The data connection will be allowed by the conntrack helper, no matter if ACTIVE or PASSIVE FTP is used.

Regards
Kurt