"
Thanks both for the clarification, and to meyergru for the excellent write-up — this is exactly the missing piece the docs don't mention.
To answer nero355's question: in my case it's not a choice, unfortunately. I'm dealing with a legacy application talking to an old FTP server that only does active mode It's being decommissioned very soon , but it still needs to keep working for a few more months, so I can't just drop FTP support in the meantime.
I followed meyergru's setup (NAT redirect to the ftp-proxy listener, TCP only, port 21) and it looks correct on my OPNsense 26.4 box — pfctl shows the rdr rule pointing to the proxy, and the service is listening. I'll test setup on site and report back here in case it helps anyone else running into the same gap in the documentation.
To answer nero355's question: in my case it's not a choice, unfortunately. I'm dealing with a legacy application talking to an old FTP server that only does active mode It's being decommissioned very soon , but it still needs to keep working for a few more months, so I can't just drop FTP support in the meantime.
I followed meyergru's setup (NAT redirect to the ftp-proxy listener, TCP only, port 21) and it looks correct on my OPNsense 26.4 box — pfctl shows the rdr rule pointing to the proxy, and the service is listening. I'll test setup on site and report back here in case it helps anyone else running into the same gap in the documentation.
