The official documentation (https://forum.opnsense.org/index.php?topic=3868.0) currently does not describe the complete setup of
os-ftp-proxy and the old how-to (https://forum.opnsense.org/index.php?topic=3868.0) explains the concept, but it is about 10 years old and the screenshots are no longer available.
The current documentation only mentions the basic principle.
The important missing step is that merely enabling the FTP proxy service is not enough. For a transparent forward proxy you also need a NAT port-forward rule for the FTP control connection, for example:
Interface: LAN
Protocol: TCP
Source: LAN net
Destination: any
Destination port: 21
Redirect target: 127.0.0.1
Redirect port: 8021
With the proxy enabled on
127.0.0.1:8021, but without that redirect, active FTP failed here exactly as expected:
> EPRT |1|192.168.10.97|22827|
< 425 Connections to other hosts not allowed.
After adding the redirect rule, the same active FTP test worked immediately.
The proxy handles
PORT/
EPRT, substitutes an externally reachable endpoint and dynamically creates the required PF rules for the incoming FTP data connection. Therefore no permanent WAN rule for the FTP data ports is required.
This can easily be tested against the public Rebex FTP test server (https://test.rebex.net):
curl.exe -v --ftp-port - --user demo:password ftp://test.rebex.net/pub/example/readme.txt
Important limitation: this only works for plain, unencrypted FTP.
It cannot work for FTPS/TLS, because once the FTP control connection is encrypted,
ftp-proxy can no longer inspect or rewrite commands such as
PORT,
EPRT,
PASV or
EPSV, nor derive the required dynamic firewall rules from them.
The underlying
ftp-proxy behaviour is documented here (https://man.openbsd.org/ftp-proxy).
So I think the current OPNsense documentation should explicitly include
- the required NAT redirect to [tt]127.0.0.1:8021[/tt],
- an explanation that ftp-proxy dynamically opens and redirects the active-mode data connection, and
- the limitation that this cannot work with encrypted FTP control connections (FTPS/TLS).
You only need that for active FTP, which I assumed why the question was asked. These days, most FTP servers can do passive FTP.