Why active File Transfer Protocol (FTP) doesn't work with Network Address Translation (NAT) in internet environment?

Question

Is there a way to bypass nat ftp helper for a few connections and allow the rest of the FTP connections to NAT with the FTP helper module ?

The need is to NAT the FTP control and data connections without conntrack-helpers .

Answer 1

In Active FTP, the data connection is established to a port on the FTP client by the FTP server. The port number along with the IP address to which the server needs to initiate the connection is provided by the FTP client after the control connection is succesfull. When the client is behind the NAT router, the FTP server cannot initiate the connection to the provided IP address , as typically it would be a private IP address not routable on the internet.