Editing File Transfer Protocol (section)

===NAT and firewall traversal===
FTP normally transfers data by having the server connect back to the client, after the PORT command is sent by the client. This is problematic for both [[Network address translation|NATs]] and firewalls, which do not allow connections from the Internet towards internal hosts.<ref name="ncftp">{{cite web |last=Gleason |first=Mike |year=2005 |title=The File Transfer Protocol and Your Firewall/NAT |url=https://www.ncftp.com/ncftpd/doc/misc/ftp_and_firewalls.html |publisher=Ncftp.com}}</ref> For NATs, an additional complication is that the representation of the IP addresses and port number in the PORT command refer to the internal host's IP address and port, rather than the public IP address and port of the NAT.

There are two approaches to solve this problem. One is that the FTP client and FTP server use the PASV command, which causes the data connection to be established from the FTP client to the server.<ref name="ncftp" /> This is widely used by modern FTP clients. Another approach is for the NAT to alter the values of the PORT command, using an [[application-level gateway]] for this purpose.<ref name="ncftp" />
[[File:FTP model.png|thumb|A model chart of how FTP works]]