How to FTP behind a Mac with Internet sharing?

[...]

The default for most FTP servers is to run in
"Active" mode which means that after the client makes
a request the server tries to open a data channel on
the client. Hence you have to set your FTP client
to tell the server to run in "Passive" mode. In
this case the server asks the client to open a data
connection to the server. Whereabouts you have to
make this Passive setting will depend on the FTP
client you are using.

Hello Graham, and thank you for this detailed reply.

I'm using the standard MacOS X FTP: ftp.
Its man page tells:<pre>...
-A Force active mode ftp. By default, ftp will try to use passive
mode ftp and fall back to active mode if passive is not sup-
ported by the server. This option causes ftp to always use an
active connection. It is only useful for connecting to very old
servers that do not implement passive mode properly.
...</pre>

I don't understand why it isn't working correctly.
On Mac A, I've added a specific FTP rule to the Firewall,
but unfortunatelly it is incomplete. And it doesn't let
passive FTP go through Mac A:<pre>
Port Name: Other
TCP Port Number(s): 20-21
UDP Port Number(s):
Description: FTP </pre>

Should I put:<pre>
Port Name: Other
TCP Port Number(s): 20-21, 1024-65535
UDP Port Number(s):
Description: FTP </pre>

Isn't there a more fine grained solution to allow FTP to
pass through Mac A, without allowing at the same time all
the incoming TCP connections?

OK, my understanding of the OS X firewall is that it
does not automatically open up all ports for "relay"
when you have internet sharing turned on.

Exactly!

In other words it is treating your own internal
network as potentially hostile, just like the
external internet.

Therefore, yes, you need to open your firewall on Mac
A for those FTP ports BUT only for requests
coming from your internal network - which is probably
something like 192.168.x.y

Yes and it's working fine this way.

Unfortunatelly, when you open FTP access this way on a
Mac which is sharing its connection,
you can't distinguish the interface on which
this access is open through the GUI.

--
dan

Sure you can set up SCP or SFTP if you are running
the server, but if you are the client you have
to go with what the server owner has running.

To get better granularity/specificity on the IPFW
firewall via a GUI one can use the highly recommended
shareware program Flying Buttress.

Thank you for this precious information.
Tested, working, great!

Do you know any firewall that may automatically
switch from configuration to configuration when
I'm switching network locations.
(I switch through a lot of these configurations:
work, home, friends, airport, trash-net...)


--
dan