{"id":9006,"date":"2025-10-30T20:49:56","date_gmt":"2025-10-31T01:49:56","guid":{"rendered":"https:\/\/beenplus.com\/?p=9006"},"modified":"2025-10-30T20:50:25","modified_gmt":"2025-10-31T01:50:25","slug":"how-to-access-your-ftp-server-at-192-168-100-95-from-the-wan","status":"publish","type":"post","link":"https:\/\/beenplus.com\/?p=9006","title":{"rendered":"How to access your FTP server at 192.168.100.95 from the WAN on VyOS"},"content":{"rendered":"\n<p>To access your FTP server at 192.168.100.95 from the WAN, you need to configure NAT port forwarding and firewall rules:<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">1. Configure NAT Destination Rule (Port Forwarding)<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code class=\"\"># Forward FTP control port (21) from WAN to DMZ server\nset nat destination rule 110 description 'Forward FTP to DMZ server'\nset nat destination rule 110 destination port '21'\nset nat destination rule 110 inbound-interface name 'eth2.201'\nset nat destination rule 110 protocol 'tcp'\nset nat destination rule 110 translation address '192.168.100.95'\nset nat destination rule 110 translation port '21'\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">2. Add Firewall Forward Rule<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code class=\"\"># Allow FTP traffic from WAN to DMZ server\nset firewall ipv4 forward filter rule 35 action 'accept'\nset firewall ipv4 forward filter rule 35 description 'Allow FTP from WAN to DMZ'\nset firewall ipv4 forward filter rule 35 destination address '192.168.100.95'\nset firewall ipv4 forward filter rule 35 destination port '21'\nset firewall ipv4 forward filter rule 35 inbound-interface name 'eth2.201'\nset firewall ipv4 forward filter rule 35 outbound-interface name 'br1'\nset firewall ipv4 forward filter rule 35 protocol 'tcp'\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">3. For Passive FTP (Recommended)<\/h2>\n\n\n\n<p>If using passive FTP, you need to forward the passive port range. Configure your FTP server to use a specific passive port range (e.g., 50000-51000), then:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code class=\"\"># Forward passive FTP port range\nset nat destination rule 111 description 'Forward FTP passive ports to DMZ'\nset nat destination rule 111 destination port '50000-51000'\nset nat destination rule 111 inbound-interface name 'eth2.201'\nset nat destination rule 111 protocol 'tcp'\nset nat destination rule 111 translation address '192.168.100.95'\n\n# Allow passive FTP ports through firewall\nset firewall ipv4 forward filter rule 36 action 'accept'\nset firewall ipv4 forward filter rule 36 description 'Allow FTP passive from WAN to DMZ'\nset firewall ipv4 forward filter rule 36 destination address '192.168.100.95'\nset firewall ipv4 forward filter rule 36 destination port '50000-51000'\nset firewall ipv4 forward filter rule 36 inbound-interface name 'eth2.201'\nset firewall ipv4 forward filter rule 36 outbound-interface name 'br1'\nset firewall ipv4 forward filter rule 36 protocol 'tcp'\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">4. Apply Configuration<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code class=\"\">commit\nsave\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">5. Verify FTP Conntrack Module<\/h2>\n\n\n\n<p>Good news! Your config already has FTP connection tracking enabled:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code class=\"\">set system conntrack modules ftp\n<\/code><\/pre>\n\n\n\n<p>This helps the firewall understand FTP&#8217;s secondary data connections.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Access from WAN<\/h2>\n\n\n\n<p>Once configured, access your FTP server using your WAN IP address:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code class=\"\">ftp &lt;your-wan-ip&gt;\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Important Notes:<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Get your WAN IP<\/strong>: Run <code>show interfaces ethernet eth2.201<\/code> to see your current WAN IP<\/li>\n\n\n\n<li><strong>FTP Server Configuration<\/strong>: Make sure your FTP server (at 192.168.100.95) is configured for:\n<ul class=\"wp-block-list\">\n<li>Passive mode with the port range you forwarded (50000-51000)<\/li>\n\n\n\n<li>The correct external IP address for passive mode announcements<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Security<\/strong>: Consider using SFTP (port 22) or FTPS (ports 21, 990) instead of plain FTP for better security<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Testing:<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code class=\"\"># From outside your network, test FTP connection\ntelnet &lt;your-wan-ip&gt; 21\n\n# Or use FTP client\nftp &lt;your-wan-ip&gt;\n<\/code><\/pre>\n\n\n\n<p>Would you like help configuring secure FTP (FTPS) or SFTP instead?<\/p>\n","protected":false},"excerpt":{"rendered":"<p>To access your FTP server at 192.168.100.95 from the WAN, you need to configure NAT port forwarding and firewall rules: 1. Configure NAT Destination Rule (Port Forwarding) 2.<\/p>\n<p class=\"link-more\"><a class=\"rm-button\" href=\"https:\/\/beenplus.com\/?p=9006\">Read More<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[96],"tags":[],"class_list":["post-9006","post","type-post","status-publish","format-standard","hentry","category-vyos"],"_links":{"self":[{"href":"https:\/\/beenplus.com\/index.php?rest_route=\/wp\/v2\/posts\/9006","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/beenplus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/beenplus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/beenplus.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/beenplus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9006"}],"version-history":[{"count":2,"href":"https:\/\/beenplus.com\/index.php?rest_route=\/wp\/v2\/posts\/9006\/revisions"}],"predecessor-version":[{"id":9008,"href":"https:\/\/beenplus.com\/index.php?rest_route=\/wp\/v2\/posts\/9006\/revisions\/9008"}],"wp:attachment":[{"href":"https:\/\/beenplus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9006"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/beenplus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9006"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/beenplus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9006"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}