The previous example was a simple one. We want our internal network users to be able to log into FTP servers on the Internet to read and write files. But we don't want people on the Internet to be able to log into our FTP servers. Well, not necessarily. In active mode, the server actually makes the connection to the client.
Active mode is usually the default.
The differences are illustrated in Figure 9-3 . Many FTP servers make their data connection from port 20 when operating in active mode, which simplifies things for us a little, but unfortunately not all do. Take a look at our rule for port 20, the FTP-data port. The rule as we have it now assumes that the connection will be made by our client to the server. This will work if we use passive mode.